Senior Information Technology Security Analyst

Sanderson; Wokingham; Remote; GBP 65,000 - 90,000; Full time

Job summary

Sanderson is recruiting a Senior IT Security Analyst to support a growing Security Operations function with a strong focus on information security assurance, governance and audit.

You’ll own audit activity, keep evidence and actions well organised, and help colleagues and customers understand how security controls are managed, while engaging with security tools and operations.

Location: Home-based with occasional travel to company offices.

Qualifications

• Experience in information security, governance, risk and compliance (GRC) or related role.
• Practical experience supporting audits, maintaining evidence and tracking actions.
• Working knowledge of ISO 27001 and ISMS practices.
• Experience responding to customer security questionnaires.
• Ability to coordinate work and explain security matters clearly to stakeholders.

Responsibilities

• Support security audits and assurance activity, gathering evidence and keeping records up to date.
• Help maintain the ISMS and support ISO 27001 control reviews and audit readiness.
• Track remediation actions, coordinate with owners and follow up to ensure completion.
• Respond to customer security questionnaires and due-diligence requests, coordinating answers with relevant teams.
• Oversee task allocation and follow-up through assurance workflows and tools.
• Advise colleagues on security questions and act as an escalation point with the wider security team.
• Support the broader Security Operations function and engage with technical security issues.

Skills

Information security

Security governance

Audit & assurance

Customer inquiries

ISMS ISO27001

Tools

Defender XDR

Entra ID

Intune

Purview

Qualys

Wiz

InsightIDR

SharePoint

SecurityScorecard

Drata

Job description

We’re recruiting a Senior IT Security Analyst to support a growing Security Operations function, with a strong focus on information security assurance, governance and audit.

This role would suit someone who enjoys taking ownership of audit activity, keeping evidence and actions organised, and helping colleagues and customers understand how security controls are managed. You’ll also need enough technical security knowledge to engage with operational issues and security tools.

What you’ll do

• Support security audits and assurance activity, gathering evidence and keeping records up to date.
• Help maintain the Information Security Management System (ISMS) and support ISO 27001 control reviews and audit readiness.
• Track remediation actions, coordinate with owners and follow up to help ensure actions are completed.
• Respond to customer security questionnaires and due-diligence requests, coordinating answers with relevant teams.
• Oversee task allocation and follow-up through assurance workflows and tools.
• Advise colleagues on security questions and act as an escalation point, involving the wider security team where needed.
• Support the broader Security Operations function and engage with technical security issues.

What we’re looking for

• Experience in information security, security assurance, GRC, security compliance or a related role.
• Practical experience supporting audits, maintaining evidence and tracking actions through to completion.
• Working knowledge of ISO 27001, ISMS practices and security controls.
• Experience responding to customer security questionnaires or assurance requests.
• Confidence coordinating work, chasing follow-ups and explaining security matters clearly to different stakeholders.
• A working understanding of security operations and technical security tools.

Experience in a software, SaaS or technology business would be useful.

Useful experience

Familiarity with ISO 22301, Cyber Essentials Plus, Drata, SharePoint or SecurityScorecard would be beneficial. Exposure to tools such as Defender XDR, Entra ID, Intune, Purview, Qualys, Wiz or InsightIDR is also welcome.

The successful candidate will bring structure and follow-through to assurance work while remaining comfortable engaging with the technical side of security.

Location: Home-based, with occasional travel to company offices.