IT Security Analyst

Causeway; Gerrards Cross; Hybrid; GBP 40,000 - 60,000; Full time

Job summary

A leading construction software company seeks an IT Security Analyst to enhance customer assurance and manage third-party risk. The candidate will ensure compliance with security frameworks and lead vendor assessments, becoming a crucial part of a dynamic team focused on continuous improvement and security management.

Benefits

25 days annual leave + public holidays

4% matched pension

Income protection and life assurance

Access to award-winning benefits platform

24/7 EAP for mental health support

£100 fitness club allowance

Dell discounts

Private Medical Insurance

Paid study leave + volunteering days

Car scheme

Qualifications

• 3+ years in information security, GRC, or vendor risk management required.
• Experience with security questionnaires and vendor assessments essential.
• Strong knowledge of ISO 27001, SOC 2, GDPR/CCPA necessary.

Responsibilities

• Manage customer-facing security questionnaires and responses.
• Conduct vendor risk assessments using ISO 27001 and NIST frameworks.
• Track and publish security metrics for internal and external audits.

Skills

Information Security

Risk Management

Communication

Compliance

Education

Certifications: CRISC, CISSP, CISA, ISO 27001 Lead Auditor

3+ years in information security or related field

Tools

AWS

Azure

GCP

Job description

IT Security Analyst

Hybrid (UK)

Do you want to play a key role in securing customer trust and supplier integrity at a market-leading construction software company? At Causeway, we’re looking for a highly organised, detail-driven Information Security Analyst to support our customer assurance processes and lead our third-party risk management efforts.

Who Are We? We are ranked as the UK’s #1 construction-specific software player, and our mission is simple: to provide market-leading end-to-end software solutions to the construction and construction-related industries across the entire build lifecycle. If you are looking to build an exceptional career with an award-winning company, you’ve come to the right place.

Our teams are based in the UK, Europe, USA and India, working on products that are used on a global scale. We have a clear and defined roadmap to deliver over the next three years, which is centred around a large-scale digital transformation as well as continuing our growth and expansion.

We embrace diversity and equality and want our employees to feel comfortable bringing their whole selves to work. We are committed to building a team with a variety of backgrounds, skills, and views. Creating a culture of equality isn’t just the right thing to do, it improves every aspect of our business.

Purpose As Information Security Analyst, you will be a strategic contributor supporting business development and security operations. You'll manage customer-facing security questionnaires, ensuring timely and accurate responses, and drive the Third-Party Due Diligence (TPDD) programme to evaluate and monitor supplier security posture. Your work will help reduce risk exposure, maintain compliance, and uphold Causeway’s reputation as a trusted technology provider.

Responsibilities

Customer Compliance

• Own and manage responses to security-based customer questionnaires (SIG, CAIQ, bespoke).
• Work cross-functionally with Legal, Compliance, Security, Procurement, and Product teams to deliver accurate, deadline-driven responses.
• Maintain the security assurance matrix to reflect the latest controls aligned with ISO 27001, Cyber Essentials, and SOC2.
• Act as a key point of contact for information security assurance queries from customers and internal teams.

Third-Party Due Diligence

• Conduct initial and recurring vendor risk assessments using frameworks like ISO 27001, NIST 800-53, and CIS Controls.
• Score vendors, document gaps, and recommend remediation actions.
• Manage the TPDD playbook including onboarding, periodic review, and offboarding.
• Integrate tooling for evidence collection and continuous monitoring.
• Align vendor controls with SOC 2, ISO 27001, GDPR/UK GDPR, and upcoming regulations.

Metrics & Audit Support

• Track and publish key metrics including turnaround times, risk severity, and SLA adherence.
• Provide audit artefacts and metrics for internal/external audits.
• Support access reviews across internal systems and Causeway domains.

Security Team Collaboration

• Contribute to broader security initiatives and continuous improvement within the team and organisation.

Skills, Experience, and Qualifications

Essential

• 3+ years in information security, GRC, or vendor risk management.
• Experience issuing or responding to security questionnaires and DDQs.
• Solid knowledge of ISO 27001 Annex A, SOC 2, and GDPR/CCPA.
• Strong communication skills, capable of translating technical risks for varied audiences.
• Right to work in the UK/EU and ability to pass background checks.

Desirable

• Certifications: CRISC, CISSP, CISA, ISO 27001 Lead Auditor.
• Familiarity with SaaS/cloud platforms (AWS, Azure, GCP).
• Understanding of secure software supply chains (SBOM, SLSA).

Benefits As a leader in employee engagement and people management, there are fantastic benefits and rewards at Causeway. We strive, year on year, to achieve recognition as an award-winning workplace that our employees love. We’ve selected just a few of the many benefits available below to show you how we take care of our Causeway stars:

• 25 days annual leave + public holidays, increasing with length of service
• 4% matched pension
• Income protection and life assurance
• Access to our award-winning benefits platform
• We take mental health seriously and have a dedicated EAP available 24/7
• £100 allowance towards a fitness club
• Dell discounts
• Private Medical Insurance
• Paid study leave + volunteering days
• Car scheme

Carbon Footprint Like all responsible companies, Causeway is aware of the need to recognise the importance of protecting our environment and addressing the climate emergency. Causeway is a carbon neutral company, and we offset our calculated carbon footprint. However, we recognise that offsetting is not a permanent solution, so we set environmental objectives to reduce our footprint year-on-year.

Our Values We are Trusted. Do the right thing, we own this.
We are Agile. Be the change, we’re on a journey.
We are Curious. Ask questions, keep learning.
We are Driven. Get stuck in, we make it happen.