Security Assurance Analyst

The Company

Superb opportunity to join one of the world’s largest leisure travel companies, operating a global fleet of cruise ships that carry millions of guests each year.

This is an initial 6-month contract (inside IR35) with a requirement to be on-site in the Southampton office 3-days per week.

The Role

We are looking for a Security Assurance Analyst to join the Information Security Assurance Team, who provide end-to-end assurance of IT products and services across the group.

The role will require excellent IT (systems, networks, applications, hardware) and security technology knowledge (anti-malware, encryption, security logging and monitoring, network security), as well as knowledge of information governance principles (risk, legislation, standards, policy and procedures).

We need a senior consultant who has a strong technical foundation in security capabilities yet is comfortable communicating and engaging across the business to drive and assure the following key outcomes:

1. Customers are engaged and understand the information security requirements relevant to them.
   
2. Products and services are designed & maintained in line with regulatory compliance and security best practice.
   
3. Our actions constantly drive the evolution and maturity of security & risk practices within the organisation.
   
   Responsibilities:
   
   

• Work closely with delivery & operational teams, providing end to end engagement across a range of IT focused projects and products.
  
  
• Assure required levels of due diligence, risk assessments and security design across a portfolio of projects.
  
  
• Define security non-functional requirements for new products and services.
  
  
• Review and input to various design documents (HLD, LLD, data flow diagrams etc.) to ensure that Security NFRs are delivered and implemented before the product or service goes live.
  
  
• Provide advice as a technical security SME by representing the Information Security team at various project meetings or workshops.
  
  
• Providing project consultation on various compliance frameworks which currently apply to the business e.g. NIST, PCI, SOX and GDPR.
  
  
• Coordinating between projects, Security Operations and third-party vendors to ensure that security testing activities are carried out and delivered to a pre-agreed scope.
  
  
• Responsible for ensuring that any vulnerabilities identified are processed in accordance with the Information Security Risk Management process.
  
  
• Identify and track risk issues across the project and ensure the risk management lifecycle is followed.
  
  
• Ensure that new products or services follow the correct change management process and provide advice to the Change Approval Board where appropriate.
  
  
• Provide support to security incident management and compliance services when required.
  
  
• Work with key stakeholders across security and the business provide risk analysis of vulnerabilities, identify appropriate security controls and review and approve remediation activities.
  
  
• Support the wider Information Security & Risk team evolve and embed key governance artefacts and processes such as effective risk management and the development of policy & procedures.
  Communicate and educate security risk to technical and non-technical colleagues.
  
  Qualifications – essential:
  
  
• IT related degree or similar experience
  CISSP or CISM (or equivalent professional certification)
  
  Knowledge/ Experience – essential:
  
  
• Provision of Security Non-Functional Requirements against a project design
  
  
• Excellent knowledge of key compliance and control requirements relevant to the tourism & leisure industry (e.g. SOX, PCI DSS & GDPR)
  
  
• Hands on experience of key security tools and their application within Information Systems
  
  
• Application/web application security and management
  
  
• Experience of implementing information security best practices within a regulated environment
  
  
• An excellent working knowledge of National Institute of Standards and Technology Cyber Security Framework
  
  
• Knowledge and skills to manage Penetration Testing processes
  
  
• Understanding of IT concepts and architectures including Cloud, BYOD and Mobile Device Management
  
  
• Working knowledge of different delivery methodologies (Waterfall, Agile or Hybrid)
  
  Knowledge/ Experience – desirable:
  
  
• Knowledge of HTTP, SSDLC and Security Testing.
  
  
• Broader understanding of Information Security Management Systems and controls, i.e. ISO27001
  
  
• Strong risk management knowledge and experience.
  
  More details available on successful application