Senior IT Cyber Governance, Risk & Compliance Analyst

About this role

London Contractor

On Site

About us

The Fidelis Partnership is a leading privately-owned, Bermuda-based Managing General Underwriter, which, through its subsidiaries, is a global underwriter of property, bespoke and specialty insurance and reinsurance products. The Fidelis Partnership is one of the largest Managing General Underwriters globally and its operations also include outwards reinsurance, claims handling, exposure management and portfolio analytics. The Fidelis Partnership also sponsors and incubates specialist MGAs through its Pine Walk platform. The Fidelis Partnership is separately owned and managed from the ownership and management of Fidelis Insurance Group.

Across product lines and geographies, we focus on three diversified pillars: reinsurance, specialty and bespoke solutions. We are truly diversified. Our long-standing partnerships with capital providers and quota share partners make us nimble. Our breadth of expertise and capabilities deliver outstanding market returns.

The role

The Senior IT Cyber Governance, Risk & Compliance Analyst will support the development, implementation and oversight of the organisation’s IT governance, cyber risk and compliance activities. This role involves supporting IT and cyber risk assessments, compliance with relevant regulatory and control frameworks, audit activity, and the identification and tracking of vulnerabilities, control gaps and remediation actions across IT systems and processes. The Senior IT Cyber Governance, Risk & Compliance Analyst will work closely with internal stakeholders to help ensure that IT and cyber activities are aligned with regulatory expectations, internal policies and good practice.

Key accountabilities

Compliance and Risk Management

• Support compliance with applicable regulatory, IT, cyber and control frameworks, which may include DORA, ISO 27001, NIST CSF, SOX and Cyber Essentials.
• Support the evaluation and management of IT, cyber, compliance and security risks across systems, processes and operations.
• Monitor emerging technology, cyber and operational resilience risks to support proactive risk management and timely escalation.
• Assist in preparing for and supporting regulatory inspections and internal, external and third-party audits.
• Support the tracking of cyber risk remediation actions, including actions arising from risk assessments, assurance reviews, incidents, audits, control reviews and control improvement initiatives.
• Support the maintenance of the cyber risk register, including the capture of risks, issues and remediation actions, and the preparation of updates for governance forums.
• Support third-party and supplier security assurance activities, including security due diligence, assessment of supplier responses and tracking of supplier remediation actions.
• Coordinate and evidence user access reviews and privileged access reviews with system owners and the business, supporting the move to tool-based access certification.
• Perform first-line compliance monitoring and control checks against information security policies and standards, including the tracking of policy exceptions.

Policy & Procedure Development

• Support the development, implementation and updating of IT risk, cyber security and compliance policies, standards and procedures to ensure alignment with legal, regulatory, control and sound practice requirements.
• Maintain an up-to-date understanding of applicable regulatory requirements and help implement changes to comply with new or evolving regulations.
• Assist in developing and delivering internal training and awareness on IT governance, cyber risk and compliance topics.

Reporting & Communication

• Support the preparation of cyber risk, control and remediation reporting for management and governance forums.
• Support the development and tracking of key performance indicators (KPIs) related to IT risk and compliance.
• Support internal breach notification and escalation processes where required, in coordination with Legal, Data Protection and relevant stakeholders, including supporting regulatory reporting where appropriate.

Skills & experience

• Bachelor’s degree in Cybersecurity, Information Technology, Risk Management, or a related field, or equivalent experience.
• Relevant certifications such as CRISC, CISA, CISM, ISO 27001 or CISSP, or a willingness to undertake similar, are desirable.
• Minimum of 5 years’ experience in IT governance, risk management, cyber or information security, or a related role, with a strong knowledge of related control and compliance requirements.
• Working knowledge of key technology areas, including infrastructure, applications, networking, cloud services, vulnerability management, incident management and access controls.
• Experience supporting audit, regulatory or compliance activities, including evidence coordination, issue tracking and remediation follow-up. Experience with SOX compliance and ITGCs is desirable.
• Experience in insurance or wider financial services, or another regulated environment, is desirable.
• Excellent communication skills, with the ability to convey technical information to non-technical stakeholders.

Other

The Fidelis Partnership Ethos

At The Fidelis Partnership, we aim to be different while making a difference.

• We set the standard for quality in our industry. Guided by our expertise, our clients can take unique and material risks with confidence.
• Our approach is tailored and designed to deliver excellence for our clients. We are trailblazers, creating unique solutions in the (re)insurance space.
• We are experts. Our brokers and clients value the depth of our knowledge and experience. We leverage state-of-the-art underwriting technology to be a market leader.
• We believe sound ethics make for good business. We deliver value for our customers, investors and communities while actively avoid trading with industries that cause harm to people, the environment and animals.
• We pride ourselves in creating a workplace that prizes execution, meritocracy, Diversity & Inclusion. Our people herald from countless backgrounds and are united by ambition and the unabashed desire to deliver excellence every day. We provide a competitive environment that helps people cultivate themselves professionally and personally and balance a rigorous workplace with a mindset that prioritises environmental and charitable activities in our communities worldwide.

Our ethos dictates our decisions and actions. It unites us as a team of experts and colleagues and provides us with a compass for ensuring we deliver our best to every stakeholder we serve.

Diversity, Equity & Inclusion

Diversity & Inclusion in the workplace

• Insofar as possible, we aim to ensure the composition of our workforce reflects the make-up of the local community
• We have specific programmes in all our offices to support diversity within the hiring process, e.g. internship and scholarship award programmes
• This is a particular focus in Bermuda, where we engage actively with local organisations to source diverse talent and provide coaching/mentoring for underrepresented groups
• We aim to maintain a focus on equal opportunities across all stages of hiring process
• We measure and minimise the pay gap where possible.

Bring Your Whole Self to Work

Our vision is for a workplace culture where differences are valued and where diversity of background, experience and thought are welcomed. We want to create an environment where all employees, regardless of who they are, are given equal opportunities for career progression and enjoy fair reward from their and The Fidelis Partnership's successes. This will be driven by a workforce that embraces Diversity & Inclusion at every level, in every department across The Fidelis Partnership.

To ensure that all candidates have a fair opportunity to show their abilities during the recruitment process, adjustments may be required.

About compliance & regulatory roles for ex-police

Compliance, AML and regulatory roles. Working to PACE, RIPA and CPIA is a stronger regulatory grounding than most civilian applicants can offer — firms increasingly recognise this.