Risk & Controls Analyst

Bupa; Greater London; Hybrid; GBP 55,000 - 70,000; Full time

Benefits offered by this job

25 days holiday

Bupa health insurance

Enhanced pension

onsite gyms / discounts

Job summary

Bupa is seeking a Risk & Controls Analyst to strengthen our Technology and Cyber control environment across London, Staines, or Manchester. You will work with cross-functional teams to design, test, and report on controls, helping to manage regulatory obligations and drive continuous improvement.

The role focuses on governance, risk and compliance for technology, cloud, identity and access management, change control and third-party risk, with a path toward senior GRC leadership.

Qualifications

• Experience in Technology Risk, Operational Risk, Internal Controls, Audit, Information Security, Compliance or Governance.
• Understanding of risk and control concepts, including design effectiveness and operational effectiveness.
• Strong analytical and problem-solving skills with the ability to interpret complex information and identify meaningful insights.

Responsibilities

• Support the operation and continuous improvement of Bupa's Technology and Cyber control framework.
• Assist control owners in documenting processes, risks, controls, evidence requirements and testing approaches.
• Perform first-line control testing and quality assurance reviews to assess control effectiveness.
• Capture and analyse testing results, identifying themes, emerging risks and control weaknesses.
• Track control deficiencies, agreed remediation actions and management responses through to closure.
• Prepare governance packs, dashboards and reports for senior stakeholders highlighting risk and control performance.
• Support internal audit, external audit and regulatory engagements by coordinating evidence requests and responses.
• Maintain risk and control inventories, ensuring documentation remains accurate and up to date.

Skills

Technology Risk

Operational Risk

Internal Controls

Audit

Information Security

Compliance

Governance

GRC Tools

Education

Degree in IT/ Risk/ Security

Tools

Excel

Power BI

Job description

Primary Location: London (EC2R 7HJ), Staines (TW18 3DZ) or Manchester (M50 3SP)

Flexible / Hybrid Working Options

Permanent

Full Time | 37.5 Hours per Week

We Make Health Happen

At Bupa, we're passionate about technology and the important role it plays in delivering exceptional experiences for our customers, patients, residents and colleagues.

As a Risk & Controls Analyst, you'll help strengthen and maintain our Technology and Cyber control environment. Working closely with the Senior Controls Manager and control owners across Technology, Cybersecurity and Operational Risk teams, you'll support control design, assessment, testing, reporting and continuous improvement activities that help Bupa manage risk effectively and meet regulatory expectations.

This is an excellent opportunity to develop expertise in Technology Governance, Risk and Compliance (GRC) while contributing to key strategic initiatives across a global organisation.

How You'll Help Us Make Health Happen

• Support the operation and continuous improvement of Bupa's Technology and Cyber control framework.
• Assist control owners in documenting processes, risks, controls, evidence requirements and testing approaches.
• Perform first-line control testing and quality assurance reviews to assess control effectiveness.
• Capture and analyse testing results, identifying themes, emerging risks and control weaknesses.
• Track control deficiencies, agreed remediation actions and management responses through to closure.
• Prepare governance packs, dashboards and reports for senior stakeholders highlighting risk and control performance.
• Support internal audit, external audit and regulatory engagements by coordinating evidence requests and responses.
• Maintain risk and control inventories, ensuring documentation remains accurate and up to date.
• Assist with control assessments relating to cloud technologies, cybersecurity, identity and access management, change management and third-party risk.
• Partner with Technology, Cyber and Operational teams to promote control awareness and good risk management practices.
• Contribute to thematic reviews, deep dives and maturity assessments across key risk domains.
• Support the implementation of new controls within transformation programmes and technology change initiatives.
• Help identify opportunities to improve reporting, automation and control monitoring through data analytics.

Key Skills / Qualifications Needed For This Role

We're looking for someone who is analytical, organised and passionate about risk and controls. You'll bring:

• Experience in Technology Risk, Operational Risk, Internal Controls, Audit, Information Security, Compliance or Governance.
• Understanding of risk and control concepts, including design effectiveness and operational effectiveness.
• Strong analytical and problem-solving skills with the ability to interpret complex information and identify meaningful insights.
• Excellent written and verbal communication skills.
• Strong attention to detail and the ability to manage multiple priorities effectively.
• Experience creating reports and dashboards using Excel, Power BI or similar tools.
• Ability to build positive working relationships across technical and non-technical teams.
• Knowledge of control frameworks and standards such as ISO 27001, NIST, COBIT, ITIL, CIS Controls or PCI DSS.
• Understanding of technology environments including infrastructure, cloud computing, cybersecurity and technology operations.
• Experience performing controls testing, assurance reviews or audit activities.
• Knowledge of cloud security frameworks such as CSA CCM and cloud-specific NIST or ISO controls.
• Experience supporting regulatory, audit or compliance activities.
• Understanding of risk methodologies and the Three Lines Model.
• Exposure to technology transformation programmes and change initiatives.
• Experience using governance, risk and compliance (GRC) tools.
• Basic data analysis and visualisation skills.

Qualifications (Desirable but Not Essential)

• Degree in Information Technology, Business, Cybersecurity, Risk Management, Audit or a related discipline.

Relevant professional qualifications or certifications, such as:

• CISA
• CRISC
• CISSP
• CISM
• GRCP
• ITIL Foundation

Success Measures

• In this role, success will be demonstrated through:
• Timely completion of control testing and assurance activities.
• High-quality risk and control reporting delivered to stakeholders.
• Effective tracking and closure of control remediation actions.
• Positive audit and assurance outcomes.
• Increased control maturity and improved compliance across Technology and Cyber functions.
• Strong stakeholder engagement and collaboration across teams.

This role provides a pathway into:

• Technology Risk Manager
• Governance, Risk & Compliance (GRC) Lead
• Senior Controls Manager

The position is designed to develop future control leaders by building expertise across risk management, controls assurance, audit engagement, governance and regulatory compliance.

Our benefits are designed to make health happen for our people. Viva is our global wellbeing programme and includes all aspects of our health – from mental and physical, to financial, social and environmental wellbeing. We support flexible working and have a range of family friendly benefits.

Joining Bupa in this role you will receive the following benefits and more:

• 25 days holiday, increasing through length of service, with option to buy or sell
• Bupa health insurance as a benefit in kind
• An enhanced pension plan and life insurance
• Onsite gyms or local discounts where no onsite gym available
• Various other benefits and online discounts

Why Bupa?

We’re a health insurer and provider. With no shareholders, our customers are our focus. Our people are all driven by the same purpose – helping people live longer, healthier, happier lives and making a better world. We make health happen by being brave, caring and responsible in everything we do.

We encourage all of our people to “Be you at Bupa”, we champion diversity, and we understand the importance of our people representing the communities and customers we serve. That’s why we especially encourage applications from people with diverse backgrounds and experiences.

Bupa takes pride in being a Level 2 Disability Confident Employer and will aim to offer an interview/assessment to disabled applicants who best meet the minimum criteria for the role. We’re committed to ensuring you’re treated fairly during the recruitment process and offer reasonable adjustments to anyone who may benefit from accommodations to the recruitment process.