Cyber Risk Analyst

At M&G, our purpose is to give everyone real confidence to put their money to work. With a heritage dating back more than 175 years, we have a long history of innovation in savings and investments, combining asset management and insurance expertise to offer a wide range of solutions.

Our two distinct operating segments, Asset Management and Life, work together to provide access to balanced, long-term investment and savings solutions.

Through telling it like it is, owning it now and moving it forward together with care and integrity; we are creating an exceptional place to work for exceptional talent.

We will consider flexible working arrangements for any of our roles and offer workplace adjustments to ensure you have the support you need to succeed in your role.

The Cyber Risk Analyst reports to the Cyber Risk Consultant and is part of the Technology Risk Team, which forms part of the Second Line of Defence in the Non-Financial Risk function.

The Cyber Risk Analyst will support the Cyber Risk Consultant in providing independent second-line oversight of first-line cyber security across M&G plc. You will be a subject matter expert who:

• Evaluates, challenges and supports first-line on their Risk and Controls posture, associated testing and remediation.
• Manages stakeholder engagement and monitors remediation efforts to drive positive outcomes.
• Provides specialist cyber and technology risk advice to the Non-Financial Risk team and the wider business.

This role sits within Risk & Compliance and focuses on delivering clear, independent insight to support informed decision‑making.

The key responsibilities of this role are to support the delivery of second line cyber risk oversight of first line cyber security. This involves:

• Providing second-line oversight of first-line cyber controls, assessing their design, implementation and effectiveness.
• Review and advise on suitable cyber risk metrics to help maintain risk within appetite.
• Provide second line review for formal risk processes, RCSAs and assurance actions.
• Supporting first-line to track and drive remediation of findings from testing, reviews and incidents, ensuring clear remediation plans and closure.
• Reviewing first-line cyber processes and technical incident responses to identify gaps, root causes and support pragmatic remedial actions.
• Work with colleagues to provide second line oversight of cyber risk mitigation projects and control improvement initiatives to reduce exposure and provide an accurate assessment of risk.
• Communicate risk findings and recommendations clearly to stakeholders, enabling timely, informed decision‑making.

• 3+ years of experience in cyber security or appropriate technology risk function (essential)
• Well developed stakeholder engagement skills (essential)
• Broad experience or demonstrable understanding of cyber security domains, such as; risk/audit management, security architecture, Dev Sec Ops, threat intelligence, vulnerability management and incident response (essential)
• A willingness to stay up to date with the latest technologies and approaches within Cyber Risk Management (essential)
• General understanding of second-line activities: risk taxonomy, appetite, KRIs and controls (essential)
• Curious, analytical and pragmatic problem-solver
• Experience with reviewing the outputs of red teaming, penetration testing or vulnerability scanning and assessing their significance
• An awareness and interest in AI and the associated applications
• Knowledge of enterprise security products and cloud
• Comfortable with risk/issue tracking tools, risk reviews and clear stakeholder reporting
• Able to produce gap analyses against policies/standards using industry best practice
• Excellent…