Information Security Analyst – Product Assurance

Overview

In this role you will safeguard product security across the engineering lifecycle within the Data Governance and Information Security team. You will help steer improvements to the security posture in line with threat trends and business goals. Working closely with cross-functional teams, you will ensure security is built in by design and provide risk-based assurance across the product lifecycle. The role combines deep security expertise with stakeholder engagement in a flexible, agile environment, offering opportunities to influence secure product delivery at scale.

Pay / Benefits

• colleague discount across Sainsbury’s, Argos, TU, Habitat
• pensions scheme
• life cover
• bonus scheme up to 10%
• holiday allowance with option to buy additional
• health and wellbeing benefits (gym discounts, health cash plans, EAP, cycle to work, season ticket loans)

Responsibilities

• Ensure security is built in by design and verify secure product delivery with proper data protection
• Define Security Non-Functional Requirements for projects and ensure alignment with technology standards
• Collaborate with the Information Security Testing Team for ethical hacking, code reviews, and scanning
• Provide end-to-end assurance of IT products across their lifecycle with appropriate approvals
• Articulate risk in technical and non-technical terms for IT and business audiences
• Identify, assess, and manage strategic, operational, and emerging risks in Cloud and Data
• Maintain strong senior stakeholder relationships to drive risk-based decision making
• Liaise with third-party partners and providers to support Sainsburys security objectives

Key requirements

• 4+ years of experience in information or cyber security
• In-depth knowledge of security technologies and architectures (monolithic and microservices)
• Experience with containerisation (Docker, Kubernetes)
• Fundamental knowledge of logging, monitoring, load balancing/proxies, API gateways
• Fundamental knowledge of GitHub, Jenkins, Jira
• Basic knowledge of OWASP Top 10, MITRE ATT&CK, NIST, PCI-DSS, Cyber Kill Chain
• Fundamental understanding of PAM, EDR, AV, IPS, SIEM, WAF, DLP
• Ability to verify solutions with evidence of controls and testing
• Strong analytical skills and risk-based decision making
• Experience with serverless cloud technologies such as AWS storage and Lambda
• Excellent stakeholder management and communication skills

• stakeholder management
• self-drive and motivation
• ability to work independently
• security technologies and integration in cloud and microservice architectures
• containerisation (Docker, Kubernetes)
• logging, monitoring, load balancing and API gateways

…