Senior Cyber Security Analyst (Governance, Risk and Compliance)

NATS; Swanwick CP; Hybrid; GBP 70,000 - 95,000; Full time

Job summary

NATS is seeking a Senior Cyber Security Analyst to protect critical business services through robust cyber risk management. You will translate complex risks into business terms for technical teams and leaders, contribute to policy and control development, and help mature security practices across the organisation.

Working with diverse stakeholders, you will guide risk assessments, implement frameworks like ISO 27001 and NIST, and mentor junior analysts while ensuring alignment with corporate

Qualifications

• Degree in Cybersecurity, Information Security or related field or equivalent experience.
• CISMP, ISO 27001 Lead Implementer or equivalent.
• Demonstrated experience delivering initiatives to develop capability and promote compliance with security obligations.
• Experience evaluating complex security challenges across technical, process and business domains.
• Experience implementing and improving cyber security risk management frameworks, methodologies and processes.
• Experience developing and implementing risk mitigation plans, policies, processes and controls.
• Understanding and applying ISO27001 and NIST standards.
• Proven ability to communicate complex information to stakeholders at all levels.
• Mentoring and guiding other team members is a plus.

Responsibilities

• Develop and improve cyber security risk management frameworks, methodologies and processes.
• Collaborate with risk owners to create proportionate risk treatment and remediation plans.
• Challenge risk assessments and control effectiveness with constructive feedback.
• Translate threat, vulnerability and risk concepts into business implications for stakeholders.
• Maintain and develop security standards, policies and procedures.
• Deliver assurance and measurement reports to guide remedial actions.
• Drive security improvement initiatives across business areas.
• Provide technical guidance and mentorship to team members.
• Monitor regulatory developments and advise on impact to security practices.

Skills

Cybersecurity

Risk management

Security governance

Stakeholder communication

Mentoring

Education

Degree in Cybersecurity

CISMP

ISO 27001 Lead Implementer

Tools

NIST Cybersecurity Framework

ISO/IEC 27001

NIST SP 800-30

CAF (NCSC CAF)

Job description

NATS is the UK's leading air navigation service provider, handling over 2.4 million flights each year. We provide air traffic control services from two control centres and at airports around the UK. We also provide a wide range of commercial products and solutions internationally. Our people are at the heart of our purpose to advance aviation and keep the skies safe.

Job Purpose:

Our Governance Risk and Compliance Team are looking for a Senior Cyber Security Analyst to play a key role in protecting critical business services through effective cyber risk management. You will have a strong understanding of cyber security risk management, with a particular focus on the development and practical application of risk frameworks and methodologies. Crucially, you will be able to translate complex technical risks into clear business impacts and communicate them effectively to technical teams, business stakeholders and senior leaders. You will also contribute to the development and maintenance of security policies, standards and controls, ensuring that identified risks are addressed through clear, proportionate and practical security requirements.

Working with a diverse range of stakeholders, you'll provide expert guidance, challenge assumptions, and help embed a risk-based approach to cyber security across the organisation.

Our Senior Cyber Security Analysts are responsible for assessing, delivering, maintaining and maturing the security practices within the organisation, ensuring that security plans, policies and practices reflect corporate standards and good practices, support the business functions, with focus on continuous improvement.

This role will support and develop Cyber Security Analysts, initiating and managing their own work items and acting as a subject matter expert in their focus security domains.

Other duties include

• Developing, implementing and improving cyber security risk management frameworks, methodologies and processes.
• Working with risk owners to develop proportionate risk treatment and remediation plans.
• Constructively challenging risk assessments, control effectiveness and proposed risk acceptance.
• Understanding the relationship between threat, vulnerability, control effectiveness, likelihood, impact and residual risk.
• Using recognised approaches and frameworks such as ISO/IEC 27001 and ISO/IEC 27005, NIST Cybersecurity Framework, NIST SP 800-30 or the NCSC Cyber Assessment Framework (CAF).
• Develop and maintain security standards, policies, and procedures to ensure alignment with recognised frameworks e.g. ISO 27001 and NIST.
• Conduct assurance and measurement processes for organisational security capabilities, to produce insightful reports and guide remedial actions across relevant business areas.
• Plan and execute security improvement initiatives across business areas, to ensure consistent delivery and alignment with organisational security objectives.
• Provide technical guidance, support development to other members of the team, to ensure consistency in security practices.
• Monitor developments in security frameworks, regulation, and legislation, to advise on their implications and influence improvements to NATS' security processes.

Essential Qualifications, Skills and Experience

You’ll ideally have:

• Degree in Cybersecurity, Information Security / related field (or equivalent experience).
• CISMP, ISO 27001 Lead Implementer or equivalent professional certification or experience.
• Demonstrated experience in delivering initiatives which develop capability and promote compliance with security obligations.
• Experience in evaluating complex security challenges across technical, process, and business domains, applying sound judgement to deliver pragmatic and effective solutions.
• Experience in implementing and improving cyber security risk management frameworks, methodologies and processes
• Experience identifying, developing and implementing, risk mitigation plans, policies, processes and technical controls.
• Understanding and experience of applying industry standards e.g. ISO27001 and NIST.
• Demonstrates a solid understanding of security controls required to identify, assess and address information security or cyber vulnerabilities across the organisation.
• Works collaboratively across teams and disciplines, supporting colleagues and contributing to a positive team environment. Provides guidance and mentoring where appropriate.
• Communicates confidently and effectively with stakeholders at all levels, translating complex information into clear, actionable messages.
• Proactively takes ownership of personal development, setting goals and seeks opportunities to learn. Encourages and supports team growth through knowledge sharing and mentoring.

Additional Vacancy Information:

We are proud to offer a fantastic total reward package to help you thrive both personally and professionally - for more information on what NATS can offer you please visit - Why NATS?

Please note: All staff at NATS are subject to UK Security Vetting and Clearance (SC) and must maintain valid clearance throughout employment. We are unable to progress applications where an applicant does not meet eligibility requirements for clearance. For further guidance click here Security Clearance - NATS

We have adopted agile working to provide greater flexibility and increased choice over working arrangements, with the opportunity for this role to work in our modern office facilities as well as remotely. We also welcome discussions on flexible and part-time working arrangements. Find out more here.

If you share our passion to advance aviation and keep the skies safe - we would like to hear from you whatever your age, sex, race, faith, sexual orientation, gender identity, gender expression, visible or invisible disability. Individuals that bring different perspectives, skills, life experiences and backgrounds help us be at the forefront of our industry.