Information Security Analyst

About this role

This is a hybrid role working 3 days in the office (City of London location) and 2 days working from home.

Role Purpose

To deliver the governance, risk and assurance activity of the Information Security Team, ensuring the Bank’s security risks and controls are documented, assessed, tested, evidenced and managed in accordance with the standards, schemes and regulatory expectations applicable to the Bank.

To coordinate and undertake information security audits, assessments and assurance activity; maintain the certifications and attestations the Bank formally holds, namely Cyber Essentials Plus and the SWIFT Customer Security Programme (CSP); deliver the Bank’s PCI DSS compliance obligations; and maintain demonstrable alignment to recognised frameworks including ISO 27001 and NIST CSF.

To support the day-to-day operation and assurance of the Bank’s security controls, including vulnerability management, security monitoring, incident response, threat intelligence, security testing, supplier assurance and the governance of emerging technologies.

To maintain the information security risk and control environment in a continuously audit-ready state appropriate to a dual-regulated bank supervised by the PRA and FCA.

Responsibilities

• Maintain the information security risk register, recording, assessing and tracking risks, treatment plans, acceptances and exceptions in line with the Bank’s risk management framework and appetite.
• Perform information security risk assessments on systems, projects, changes, suppliers and emerging technologies, documenting findings and agreeing proportionate treatment plans with stakeholders.
• Maintain the Bank’s information security control framework, control mappings, policies and standards, ensuring documentation is current, approved, version controlled and supported by reliable evidence.
• Plan and maintain the annual information security audit and assessment calendar, covering internal audits, external audits, certification assessments, regulatory assurance and self-assessments.- Coordinate audits end to end, including scoping, scheduling, stakeholder briefings, evidence collection, auditor liaison, control walkthroughs and management responses
• Own the annual SWIFT CSP attestation cycle, maintaining compliance with the current Customer Security Controls Framework and tracking changes between releases.
• Coordinate the required independent assessment, prepare control owners, gather evidence and manage the assessor relationship through to submission in the KYC-SA portal.
• Deliver the annual Cyber Essentials Plus renewal, including assessment planning, control-owner preparation, evidence coordination, technical testing and remediation of findings so certification is maintained without lapse.
• Monitor changes to scheme requirements and assure continued compliance throughout the year, including scope, device, software, access-control, malware-protection, firewall and patching requirements.
• Coordinate preparation and distribution of Information Security governance packs, management information, supporting papers and appendices.
• Support the security assessment and governance of AI, large language model, agent and automation technologies used by the Bank
• Perform risk-based security due diligence of suppliers and outsourced services, covering certifications, assurance reports, questionnaires, technical controls, architecture, known exposures and material subcontracting arrangements.
• Monitor relevant threat intelligence, security advisories, newly registered or lookalike domains, exposed credentials and other external indicators affecting the Bank.

Skills and Experience sought

• Demonstrable experience in an information security risk, assurance, audit, compliance or security-operations role, ideally within UK financial services or another regulated environment.
• Working knowledge of at least two of SWIFT CSP, Cyber Essentials Plus, PCI DSS, ISO 27001 and NIST CSF, with the aptitude to develop depth across the remainder.
• Relevant certification desirable, such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CRISC, CISMP, Security+ or equivalent; practical experience is equally valued.
• Highly organised and able to run multiple audit, assessment, assurance and remediation workstreams against fixed external deadlines.
• Strong written skills, producing risk assessments, policies, audit reports, incident records, management responses and committee papers that are clear, precise and defensible.
• Rigorous and evidence minded, with sound judgement on what constitutes sufficient and reliable evidence that a control is appropriately designed and operating.
• The role holder must act with integrity, with due skill, care and diligence, and be open and cooperative with regulators.

Equal Opportunities

We're an equal opportunity employer, which means we'll consider all suitably qualified applicants regardless of gender identity or expression, ethnic origin, nationality, religion or beliefs, age, sexual orientation, disability status or any other protected characteristic. We recruit and develop our people based on merit and we're committed to creating an inclusive environment for all employees. During the application process, you will be asked to complete an equality questionnaire on a voluntary basis and any data we collect will be treated confidentially and used for evaluation purposes. This will be for a period of 6 months or longer with your permission. This helps us understand our applicants so we can make sure we are doing everything we can to attract a diverse range of people and ensure our recruitment processes are fair and inclusive.