Cyber Security Business Analyst

iSystems Ltd; Islamabad; On-site; PKR 2,000,000 - 3,200,000; Full time

Job summary

iSystems Ltd is seeking an experienced Cyber Security Business Analyst to consolidate security data across a global enterprise, focusing on vulnerability management, governance reporting, and data quality. You will coordinate ServiceNow CMDB data quality initiatives and review vulnerability risk acceptances.

The role requires strong analytical and stakeholder management skills, with knowledge of CVSS/EPSS and regulatory governance.

Qualifications

• Experience in cybersecurity-related business analysis.
• Strong data analysis and reporting skills using Excel/Power BI.
• Familiarity with ServiceNow CMDB and IT asset management.
• Knowledge of vulnerability management and risk scoring (CVSS/EPSS).
• Experience with regulatory reporting is a plus.

Responsibilities

• Prepare weekly security posture reports and monthly KRIs for governance bodies.
• Consolidate data from vulnerability tools and cloud platforms for reporting.
• Develop dashboards and automated reporting with Power BI.
• Validate data, investigate discrepancies, and track governance actions to closure.
• Collaborate with ServiceNow CMDB and IT asset teams to improve data quality.
• Lead market assessments of vulnerability scanning platforms.
• Prepare business cases and transition plans for tooling deployments.
• Review vulnerability risk acceptances and ensure proper ownership and expiry.
• Support regulatory, audit, and compliance reporting including DORA, Lloyd’s, PRA.
• Engage with Cyber Defence, Risk, Compliance, Procurement, and vendors.

Skills

Stakeholder management

Data analysis

Analytical skills

Reporting

Communication

Tools

Power BI

Excel

ServiceNow CMDB

Power Query

Python

Job description

We are looking for an experienced Cyber Security Business Analyst to support vulnerability management, security governance reporting, data quality, and tooling assessments across a global enterprise environment. The role will focus on consolidating security data, improving reporting accuracy, coordinating ServiceNow CMDB data quality initiatives, reviewing vulnerability risk acceptances, and leading market assessments for vulnerability scanning and aggregation platforms. The ideal candidate will possess strong analytical, reporting, business analysis, and stakeholder management skills, with an understanding of cybersecurity risk and regulatory governance.

Responsibilities

• Lead the preparation of weekly security posture reports, monthly Key Risk Indicators (KRIs), and governance reports for the Technology Risk Committee (TRC), Information Security Committee (ISC), OpsCom, and Lloyd’s oversight.
• Consolidate and reconcile data from vulnerability scanning tools, security testing, cloud platforms, and ServiceNow to establish a reliable, consistent source of security reporting.
• Develop and maintain Power BI or equivalent dashboards, trend analysis, reporting metrics, and automated reporting processes for senior stakeholders.
• Validate reporting accuracy, investigate data discrepancies, document restatements, and track governance actions through to closure.
• Liaise with ServiceNow CMDB and IT asset management teams to improve asset ownership, business criticality, CIF tagging, service relationships, and security data quality.
• Reconcile asset inventories across scanning, endpoint detection, cloud, and security testing platforms to identify missing, duplicate, stale, and unscanned assets.
• Lead the market assessment of vulnerability scanning and aggregation platforms, including requirements gathering, vendor evaluations, demonstrations, proofs of concept, cost comparisons, and integration assessments.
• Prepare business cases, recommendation papers, and transition plans for vulnerability management tooling, considering infrastructure, cloud, containers, application security, and ServiceNow/Jira integration.
• Review vulnerability risk acceptances, exceptions, and waivers to validate justifications, compensating controls, ownership, and expiry dates; flag outdated or high-risk acceptances for reassessment.
• Conduct business analysis, process mapping, requirements gathering, and stakeholder workshops to identify process gaps and recommend improvements to vulnerability management and security governance.
• Support regulatory, audit, and compliance reporting requirements, including DORA, Lloyd’s Principle 12, remediation Metric 7, and PRA engagements.
• Collaborate with Cyber Defence, IT, Risk, Compliance, Procurement, and security tooling vendors to improve reporting, operational efficiency, and governance processes.

Requirements

• Proven experience in business analysis within cybersecurity, IT risk, information security, or a related enterprise environment.
• Strong data analysis and reporting skills, including advanced Excel and Power BI or equivalent reporting and dashboarding tools.
• Working knowledge of ServiceNow CMDB, IT asset management, configuration data, and the impact of data quality on security operations.
• Understanding of vulnerability management, risk-based prioritisation, and security scoring methodologies, including CVSS, EPSS, and CISA KEV.
• Experience in technology market assessments, vendor evaluations, requirements gathering, weighted scoring, business cases, and stakeholder workshops.
• Knowledge of risk acceptance, exception management, governance, risk, and compliance (GRC) processes.
• Strong written and verbal communication skills, with the ability to translate technical security risks and data insights into clear business and committee-level reporting.
• Preferred: Financial services or insurance experience, familiarity with Tenable, Qualys, Rapid7, Vulcan, or Microsoft Defender for Cloud, regulatory reporting (DORA, Lloyd’s, PRA), CMDB improvement initiatives, reporting automation using Power Query or Python, and certifications such as CBAP, BCS Business Analysis, ITIL, Security+, or CRISC.