Cyber Security Business Analyst

Systems Limited; Lahore; On-site; PKR 1,800,000 - 3,200,000; Full time

Job summary

Systems Limited is seeking an experienced Cyber Security Business Analyst to support vulnerability management, governance reporting, data quality, and tooling assessments across a global enterprise environment. You will consolidate security data, improve reporting accuracy, and lead market assessments for vulnerability scanning platforms.

The role requires strong analytical, reporting, and stakeholder management skills with an understanding of cybersecurity risk and regulatory governance.

Qualifications

• Proven experience in business analysis within cybersecurity, IT risk, or information security.
• Strong data analysis and reporting skills using Excel, Power BI or equivalent tools.
• Working knowledge of ServiceNow CMDB and IT asset management and data quality impacts.
• Familiarity with vulnerability management, risk prioritisation, and security scoring methods (CVSS/EPSS/KEV).

Responsibilities

• Lead weekly security posture reports and governance reporting for TRC/ISC/OpsCom and oversight.
• Consolidate data from vulnerability tools, cloud platforms, and ServiceNow for reliable reporting.
• Develop dashboards and automated reporting processes for senior stakeholders.
• Validate reporting accuracy, investigate data discrepancies, and track governance actions to closure.
• Collaborate with IT asset management and CMDB teams to improve data quality and asset ownership.
• Conduct market assessments of vulnerability scanning and aggregation platforms.
• Prepare business cases and transition plans for tooling integrations.

Skills

Data analysis

Stakeholder management

Cybersecurity risk understanding

Communication skills

Tools

Power BI

ServiceNow CMDB

Excel

Job description

We are looking for an experienced Cyber Security Business Analyst to support vulnerability management, security governance reporting, data quality, and tooling assessments across a global enterprise environment. The role will focus on consolidating security data, improving reporting accuracy, coordinating ServiceNow CMDB data quality initiatives, reviewing vulnerability risk acceptances, and leading market assessments for vulnerability scanning and aggregation platforms. The ideal candidate will possess strong analytical, reporting, business analysis, and stakeholder management skills, with an understanding of cybersecurity risk and regulatory governance.

Responsibilities

• Lead the preparation of weekly security posture reports, monthly Key Risk Indicators (KRIs), and governance reports for the Technology Risk Committee (TRC), Information Security Committee (ISC), OpsCom, and Lloyd's oversight.
• Consolidate and reconcile data from vulnerability scanning tools, security testing, cloud platforms, and ServiceNow to establish a reliable, consistent source of security reporting.
• Develop and maintain Power BI or equivalent dashboards, trend analysis, reporting metrics, and automated reporting processes for senior stakeholders.
• Validate reporting accuracy, investigate data discrepancies, document restatements, and track governance actions through to closure.
• Liaise with ServiceNow CMDB and IT asset management teams to improve asset ownership, business criticality, CIF tagging, service relationships, and security data quality.
• Reconcile asset inventories across scanning, endpoint detection, cloud, and security testing platforms to identify missing, duplicate, stale, and unscanned assets.
• Lead the market assessment of vulnerability scanning and aggregation platforms, including requirements gathering, vendor evaluations, demonstrations, proofs of concept, cost comparisons, and integration assessments.
• Prepare business cases, recommendation papers, and transition plans for vulnerability management tooling, considering infrastructure, cloud, containers, application security, and ServiceNow/Jira integration.
• Review vulnerability risk acceptances, exceptions, and waivers to validate justifications, compensating controls, ownership, and expiry dates; flag outdated or high-risk acceptances for reassessment.
• Conduct business analysis, process mapping, requirements gathering, and stakeholder workshops to identify process gaps and recommend improvements to vulnerability management and security governance.
• Support regulatory, audit, and compliance reporting requirements, including DORA, Lloyd's Principle 12, remediation Metric 7, and PRA engagements.
• Collaborate with Cyber Defence, IT, Risk, Compliance, Procurement, and security tooling vendors to improve reporting, operational efficiency, and governance processes.

Requirements

• Proven experience in business analysis within cybersecurity, IT risk, information security, or a related enterprise environment.
• Strong data analysis and reporting skills, including advanced Excel and Power BI or equivalent reporting and dashboarding tools.
• Working knowledge of ServiceNow CMDB, IT asset management, configuration data, and the impact of data quality on security operations.
• Understanding of vulnerability management, risk-based prioritisation, and security scoring methodologies, including CVSS, EPSS, and CISA KEV.
• Experience in technology market assessments, vendor evaluations, requirements gathering, weighted scoring, business cases, and stakeholder workshops.
• Knowledge of risk acceptance, exception management, governance, risk, and compliance (GRC) processes.
• Strong written and verbal communication skills, with the ability to translate technical security risks and data insights into clear business and committee-level reporting.
• Preferred: Financial services or insurance experience, familiarity with Tenable, Qualys, Rapid7, Vulcan, or Microsoft Defender for Cloud, regulatory reporting (DORA, Lloyd's, PRA), CMDB improvement initiatives, reporting automation using Power Query or Python, and certifications such as CBAP, BCS Business Analysis, ITIL, Security+, or CRISC.