Security Risk Analyst

Nominet; Oxford; Hybrid; GBP 52,000 - 72,000; Full time

Benefits offered by this job

Early Finish Friday

34-hour working week with full-timepay

Bank holidays + extra 5 days

Bupa private healthcare

Pension scheme 7% match

Electric vehicle on-site charging

Rewards platform discounts

Medicash discounts

Annual company bonus

Job summary

Nominet is seeking a Cyber Security Risk Analyst to help understand and manage cyber and information security risk across our infrastructure, services, suppliers and data. You’ll identify risks, assess controls, and ensure treatment plans are in place, building a risk-aware culture with clear records and practical guidance.

You’ll collaborate with technology, operations, procurement and business teams, communicating findings clearly and supporting proportionate risk responses.

Qualifications

• Experience supporting, managing, implementing or auditing security risk, compliance or assurance activity.
• Ability to assess controls and risks, work with owners on practical actions, and maintain auditable records.
• Knowledge of information security standards or guidance (ISO 27001, NIST, CIS Controls, NCSC).

Responsibilities

• Assess security risks and controls across systems, projects, and suppliers using relevant standards.
• Identify control gaps and track risk treatment plans and remediation.
• Support supplier security assessments and ensure actions are completed.
• Maintain clear records of risks, controls and compliance obligations for stakeholders.
• Help improve Nominet’s security risk approach, policies and standards.

Skills

Risk management

Security assessment

ISO 27001

NIST

CIS Controls

NCSC guidance

Supplier risk

Incident response

Access management

Vulnerability mgmt

Audit records

Stakeholders

Job description

Select how often (in days) to receive an alert: Create Alert

Location:Hybrid, with a minimum of 20% in the Oxford office per month

About Us:

We’re Nominet – a world-leading domain name registry operating at the heart of the UK internet. While we're best known for running .UK domains, our DNS expertise also underpins critical internet infrastructure that government services, including the NHS, rely on.
As a public benefit company, our work has a positive impact on society. We’ve donated millions to projects that use technology to improve people’s lives and have committed to delivering £60m worth of support over the next three years.

The Role:

As a Cyber Security Risk Analyst, you’ll help Nominet understand and manage cyber and information security risk across our infrastructure, services, suppliers and data. Security and resilience are central to our work, and this role helps ensure risks are recognised, owned and addressed.

You’ll identify and assess risks and control gaps, help clarify security obligations, and make sure appropriate treatment plans are in place. Working with colleagues across technology, operations, procurement and the wider business, you’ll assess controls, track remediation and turn complex security information into clear, practical advice. In doing so, you’ll help build a risk-aware culture where colleagues understand security risks and their responsibilities.

This role will suit someone who enjoys detailed analysis, exercises sound judgement and communicates well with people outside security. You’ll take a proportionate approach to risk and keep accurate records that support good decisions.

What You'll Be Doing:

• Assess security risks and controls across systems, projects, business areas and suppliers, using relevant standards and guidance such as ISO 27001, NIST, CIS Controls and the NCSC Cyber Assessment Framework.
• Identify control gaps and track risk treatment plans, exceptions, corrective actions and remediation with their owners.
• Support supplier security assessments and follow agreed actions through to completion.
• Maintain clear records of risks, controls, compliance obligations and assurance activity so stakeholders can understand risk exposure and progress.
• Help improve Nominet’s security risk approach, policies and standards, keeping them clear and proportionate.

About You:

• You’ll have experience supporting, managing, implementing or auditing security risk, compliance or assurance activity.
• You can assess controls and risks, work with owners on practical actions, and maintain accurate, auditable records.
• Knowledge of information security standards or guidance, such as ISO 27001, NIST, CIS Controls or NCSC guidance.
• An understanding of supplier security risk and a broad range of controls, including access management, vulnerability management and incident response.
• The ability to analyse qualitative and quantitative information, explain findings clearly, and work with stakeholders to resolve issues.
• Strong analytical and communication skills, with the ability to explain risks clearly, work with stakeholders and maintain accurate records.

What to expect next:

1st stage: Introduction call with a member of the TA team (30-45 mins)

2nd stage: Hiring manager interview (30 mins)

3rd stage: Onsite interview (60 mins)

Our Values:

• We Make Things Happen
• We Pull Together
• We Bring A Positive Mindset
• We Keep It Simple

Our people make things happen, but our values are our compass as a company, guiding our day-to-day work and building our culture. They reflect that we’re strongest when we’re proactive and pull together, while underlining the importance of a "glass half full" mindset and aiming to keep things simple for success.

What We Offer:

• Early Finish Friday – 34-hour working week with full-time pay (finish at midday on Friday)
• 30 days annual leave plus bank holidays, with the option to buy an additional 5 days
• Bupa private healthcare + Employee Assistance Programme
• Pension scheme matched to 7%
• Electric vehicle scheme with on-site charging points
• Rewards platform with discounts at hundreds of retailers and restaurants
• Medicash discounts on routine healthcare including optical and dental
• Annual company bonus

Diversity Statement:

We're passionate about creating a workplace where every individual is valued, respected, and empowered. Somewhere we can benefit from all forms of diversity and discover the true value in our differences. If there are any adjustments we could make to the recruitment and selection process to support you, please let us know.

Security Statement:

Nominet is committed to the safeguarding and welfare of the internet and expects all employees and volunteers to share this commitment by participating in the relevant security and screening processes. All roles working for Nominet will be subject to a Baseline Personnel Security Standard (BPSS) check. Some roles, due to the nature of their work, will require additional security clearance.

Please note that Nominet is unable to provide visa sponsorship or relocation support for this position.