Security Risk Analyst

Elmax Search; Greater London; Hybrid; GBP 65,000 - 90,000; Full time

Job summary

Elmax Search is seeking an Information Security Risk Analyst in London. Join a global investment manager with a modern tech agenda and take ownership of how security risk is identified, assessed and communicated across the business.

You will run risk assessments on new systems and supplier risk, align controls with ISO 27001 and NIST CSF, and contribute to governance, regulatory compliance (FCA, DORA, GDPR) and risk reporting.

Qualifications

• 5+ years in information security, IT risk, audit or GRC.
• Hands-on experience maintaining a risk register, assessing controls and tracking remediation.
• Solid technical understanding across infrastructure, networks, cloud, identity and applications.
• Working knowledge of ISO 27001, NIST CSF or similar, and applying FCA, DORA and GDPR requirements.
• Clear communicator who can present findings to engineers and senior business stakeholders.

Responsibilities

• Run security risk assessments on new systems, changes, projects and emerging technology, including AI tools and integrations.
• Own third-party security risk: supplier and cloud due diligence, plus ongoing monitoring.
• Assess security controls against ISO 27001 and NIST CSF, and track remediation through to closure.
• Maintain the Information Security Risk Register, with clear ownership, treatment plans and escalation.
• Produce monthly security KRIs, turning threat, vulnerability and incident data into business risk.
• Support security governance: risk forums, senior management reporting, policy exceptions and risk acceptances.
• Monitor regulatory requirements (FCA, DORA, GDPR), support audits and respond to client security due diligence.

Skills

risk assessment

security governance

ISO 27001

NIST CSF

regulatory compliance

Job description

Information Security Risk Analyst | Global Investment Manager | London/Hybrid (2-3 days onsite)

A global, long-term investment management firm with a strong reputation and a growing technology investment is hiring an Information Security Risk Analyst. The firm treats technology as a real source of investment edge and is modernising its core platform, data and AI capability. This role sits in a small, high-impact Security team, reporting to the Security Manager, with real ownership of how security risk is identified, assessed and communicated across the business.

The role

• Run security risk assessments on new systems, changes, projects and emerging technology, including AI tools and integrations
• Own third-party security risk: supplier and cloud due diligence, plus ongoing monitoring
• Assess security controls against ISO 27001 and NIST CSF, and track remediation through to closure
• Maintain the Information Security Risk Register, with clear ownership, treatment plans and escalation
• Produce monthly security KRIs, turning threat, vulnerability and incident data into business risk
• Support security governance: risk forums, senior management reporting, policy exceptions and risk acceptances
• Monitor regulatory requirements (FCA, DORA, GDPR), support audits and respond to client security due diligence

What we're looking for

• 5+ years in information security, IT risk, audit or GRC, running risk processes independently
• Hands-on experience maintaining a risk register, assessing controls and tracking remediation
• Solid technical understanding across infrastructure, networks, cloud, identity and applications
• Working knowledge of ISO 27001, NIST CSF or similar, and applying FCA, DORA and GDPR requirements
• Clear communicator who can present findings to both engineers and senior business stakeholders

Nice to have: CISM, CRISC, CISSP or ISO 27001 Lead Implementer/Auditor, financial services experience, and exposure to assessing AI risk or using AI to automate risk reporting.