InfoSec Assurance Analyst
Upto £57,500 + Enterprise Benefits (Life Ins/Medical/Pension)
Fully Remote (UK only)
***Please Note: NOT A CYBER SEC TECHNICAL ROLE***
Be part of their high growth Information Security plans as they build the team to x4
Cloud Decisions have partnered with one of the UK’s most exciting enterprise technology transformations: a £multi-billion, employee-owned group, one of the top 10 largest employee-owned business in the UK, and one of the largest global players in insurance across (100+ countries).
Following a wave of acquisitions and continued digital modernisation and compliance, they’re hiring an Information Security Assurance Analyst with who understands the Controls & Compliance with security regulations and standards and is able to work join a small, high-trust team and that can work autonomously while they build their InfoSec capability to ensures regulatory compliance, information security maturity, and readiness for the next audit, tender or risk review.
Control/Compliance Assessment Duties:
- Schedule and Coordinate Assessments: Schedule and coordinate control assessments with control owners, asset custodians, and third parties.
- Evaluate Controls: Assess the design and effectiveness of technical and non-technical security controls against internal policies, standards, and procedures.
- Documentation Maintenance: Maintain up-to-date documentation of security control assessments and remediation activities.
- Organise Control Evidence: Ensure all control evidence is well-organised and accessible.
- Notify Deviations: Author notifications of business process and procedure deviations to inform the Information Security team and other relevant parties across the organisation.
- Risk Analysis Reports: Author analysis reports that define the impact of control deficiencies or gaps on identified risks.
- Communicate Findings: Communicate findings to Security leadership, clearly describing issues identified from analysis.
- Dashboard and Reporting Input: Provide input to ensure dashboards and reporting databases are up to date with current details.
- System Security Plans (SSPs):Provide support to data and/or process owners in formally documenting the security requirements for information systems, applications, and services. This includes assisting with the scoping, selection and documentation of appropriate cybersecurity and privacy controls, testing their design and implementation, following a formal authorisation process, and establishing mechanisms for ongoing monitoring and oversight of controls.
Compliance/Control Improvement Duties
- Update Processes: Initiate and coordinate the process to update identified business process breaks/gaps.
- Enhance Procedures: Assist in the documentation, design, and enhancement of procedures, and develop operating effectiveness tests with control owners.
- Propose Enhancements: Propose enhancements to existing controls and procedures through a formal reporting structure.
- Reporting Support: Assist in monthly and quarterly reporting on the status and outcomes of control assessment activities.
Audit/Assessment Duties:
- Third-Party Due Diligence: Manage third-party due diligence requests from customers and insurers, ensuring accurate and timely responses. Document and report deficiencies and serve as the primary liaison to resolve actions within agreed timescales.
- Audit Preparation and Support: Prepare for and assist with internal and external audits by collecting evidence, responding to audit requests, and addressing audit findings.
InfoSec effectiveness - collaboration/continuous improvement:
- Continuous Improvement:Identify opportunities for process improvements and implement changes to enhance the efficiency and effectiveness of control assessments.
- Training and Development:Assist in training team members and stakeholders on control assessment methodology and assessment best practices.
- Vendor Management: Ensure critical vendors have robust BCDR plans and conduct regular assessments. Conduct regular assessments of vendor BCDR capabilities.
Any knowledge of the Information Security impact requirements of DORA, PCDSS, SARBOX are all of great interest but not essential.
