Senior Technology Risk Analyst

Academic Key; Greater London; Hybrid; GBP 70,000 - 100,000; Full time

Job summary

WPP in London is seeking a Senior Technology Risk Analyst to lead the Information Security Management System (ISMS) across Data & Technology Solutions. You will own governance of policies, controls, risks, and risk treatment, and work with product, engineering, infrastructure, legal, and risk teams to keep security programs dynamic and compliant.

You will run the Risk Review Board, maintain the central risk register, collect evidence for ISO 27001, SOC 2 and GDPR, and support audit readiness

Qualifications

• Experience owning and operating an Information Security Management System (ISMS).
• Ability to manage security policies, controls, risks, exceptions and governance processes.
• Proven experience leading Governance, Risk and Compliance (GRC) programs and cross-functional collaboration.

Responsibilities

• ISMS Ownership & Operation: manage day-to-day ISMS activities and maintain documentation.
• Policy Management: own lifecycle of security policies and standards across DTS.
• Risk Review Board: establish cadence, prepare risk packs and track actions.
• Risk Register: maintain central risk register with risk scores and mitigations.
• Control Evidence: ensure evidence collection for ISO 27001, SOC 2, GDPR, etc.
• Audit Readiness: support compliance obligations and internal/external audits.

Skills

ISMS management

Risk management

Policy management

GRC

ISO 27001

SOC 2

GDPR

HIPAA

Job description

WPP is the trusted growth partner for the world’s leading brands. We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company – powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth. We work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise. Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow. For more information, visit WPP.com. Senior Technology Risk Analyst Department: Data & Technology Solutions (DTS) Reports To: SVP Security and Compliance Location: [London/Hybrid 2 days a week in office] Position Type: Full‑Time Role Purpose The Senior Technology Risk Analyst is responsible for managing and continuously improving the Information Security Management System (ISMS) across Data & Technology Solutions. You will ensure that security policies, controls, risks, exceptions, and governance processes are properly maintained, evidenced, reviewed, and acted upon. Reporting to the SVP Security and Compliance, you will provide the operational backbone for security governance across DTS. This is a hands‑on Governance, Risk, and Compliance (GRC) role. You will collaborate across security, product, engineering, infrastructure, architecture, legal, risk, compliance, and delivery teams to transform security governance into a dynamic, working management system rather than a static documentation exercise. Key Responsibilities 1. ISMS Ownership & Operation Manage the day‑to‑day operation and continuous improvement of the DTS ISMS. Maintain the ISMS framework, documentation, control library, policies, standards, and procedures. Ensure the ISMS accurately reflects how DTS operates across products, platforms, infrastructure, data, and engineering. Support alignment with frameworks such as ISO 27001, SOC 2, GDPR, HIPAA (where applicable), and wider WPP security requirements. Ensure ISMS artefacts are version‑controlled, approved, reviewed, and communicated appropriately. Maintain clear evidence of security governance activity, control operation, risk treatment, and management reviews. 2. Policy Management & Control Governance Own the lifecycle of DTS security and compliance policies, standards, procedures, and control documentation. Coordinate policy reviews with Security, Architecture, Infrastructure, Engineering, Product, Legal, Risk, and Enterprise Technology stakeholders. Ensure policies are practical, clear, enforceable, and aligned with DTS's operating reality. Track policy exceptions, waivers, compensating controls, and review dates. Ensure policy changes are communicated and seamlessly embedded into operational processes. 3. Risk Review Board Operation Establish and continuously run the DTS Risk Review Board. Define the Board’s cadence, agenda, inputs, outputs, attendees, and escalation routes. Prepare comprehensive risk packs, dashboards, decision logs, and action trackers. Ensure risks are presented clearly, consistently, and with appropriate supporting evidence. Track decisions, owners, due dates, mitigations, exceptions, and residual risks. Escalate risks exceeding agreed thresholds to the SVP Security and Compliance, DTS leadership, the CISO office, or other appropriate forums. 4. Risk Register Management Own and maintain the central DTS security and compliance risk register. Capture, assess, categorise, and maintain security, compliance, privacy, operational resilience, third‑party, and technology risks. Ensure all risks have clear descriptions, owners, likelihood/impact ratings, inherent risk scores, mitigations, residual risk scores, treatment plans, and target dates. Partner with risk owners to ensure mitigations are realistic, funded, and actively progressed. Track overdue risk actions and elevate insufficient progress. Produce regular risk reporting for DTS leadership and wider WPP governance forums. 5. Control Assurance & Evidence Management Support ongoing assurance activity by ensuring controls are consistently evidenced, tested, and reviewed. Maintain control evidence for ISO 27001, SOC 2, client assurance, internal audits, and other compliance needs. Coordinate evidence collection from Engineering, Infrastructure, Security, Product, HR, Legal, and Enterprise Technology. Identify gaps between documented controls and actual operating practices, tracking remediation plans. 6. Compliance Support & Audit Readiness Support DTS compliance obligations (ISO 27001, SOC 2, HIPAA, GDPR)

Senior Technology Risk Analyst

Wpp