InfoSec Governance, Risk and Compliance Analyst

Experteer Overview In this role, you will support the Information Security team to maintain clear standards, assess risk, and provide assurance that controls are understood, evidenced, and reviewed across the business. You will work across multiple areas and may travel between sites, with hybrid working supported. You will help shape governance, risk and compliance activities to sustain secure operations in a regulated environment, contributing to continuous improvement of the Information Security Operating Model.

This is an opportunity to apply your expertise to real-world security governance challenges and collaborate with diverse stakeholders. Pay / Benefits

• Support the Head of Governance, Risk and Compliance with day-to-day governance, risk and compliance workload
• Maintain security standards, control mappings and assurance processes
• Support reviews of security management and assurance plans to ensure proper description, evidence and alignment to standards
• Conduct or support risk assessments and document risk positions with appropriate reviews
• Conduct audit and assurance activity across Leonardo UK systems and services
• Track non-compliances, remediation activity and risk acceptance decisions
• Collaborate with delivery teams, system owners and security specialists to gather evidence and support governance
• Contribute to compliance, risk and assurance reporting for the Information Security function
• Support continual improvement of the Information Security Operating Model, including data use, tooling and automation
• Experience in information security governance, risk and compliance, assurance or audit
• Knowledge of security control frameworks and risk management practices
• Understanding of cyber and information risk frameworks and methodologies
• Understanding of MoD and other UK government security policy and frameworks
• Familiarity with security standards, policies, control frameworks or risk management artefacts
• Practical understanding of risk assessment, residual risk, risk acceptance and non-compliance management
• Experience supporting audits, assurance reviews, control testing or compliance reporting
• Ability to review evidence and assess whether security controls are clearly described and supported
• Experience working with technical and non-technical stakeholders to gather information for risk or assurance activity
• Professional security qualification such as CISSP, CISM, CRISC, ISO 27001 Lead Implementer/Auditor or willingness to work towards one
• Knowledge of governance tooling, dashboards, data analysis or automation (beneficial)
• Key requirements generous leave with up to 12 flexi-days pension scheme with up to 15% employer contribution mental health support bonus scheme free access to 4,000+ online courses hybrid working