Security Analyst

Overview

In this role you will oversee third-party security risk management within a multi-entity environment, guiding risk governance and regulatory compliance. You’ll collaborate with Legal, Privacy, Compliance, and Procurement to evaluate supplier controls and drive remediation across the lifecycle. You will support audit and customer assurance efforts, using GRC tools to monitor risks and deliver clear, risk-based insights to stakeholders. This is a chance to shape TPSA processes and strengthen security across partners and acquisitions.

Pay / Benefits

• flexible work options
• learning and development opportunities
• tailored wellbeing and financial wellbeing benefits
• equal opportunities
• diversity and inclusion commitment

Responsibilities

• Collaborate with cross-functional teams (Legal, Procurement, Privacy, Compliance)
• Provide risk-based insights to stakeholders to inform decisions
• Support audit, regulatory, and customer assurance requirements
• Leverage GRC platforms (OneTrust, BitSight, internal SaaS) to manage TPSA activities
• Develop dashboards and reports (Power BI, SharePoint) for governance and SLAs
• Contribute to governance forums and risk review meetings
• Ensure adherence to TPSA tiering models, standards, and processes
• Maintain oversight of third-party risks across the vendor lifecycle
• Perform periodic reassessments and continuous monitoring
• Track remediation activities and risk treatment plans through closure
• Maintain third-party risk registers, dashboards, and management reporting
• Escalate material risks and control deficiencies to governance forums
• Partner with Procurement, Legal, Compliance, Privacy, Enterprise Risk, Internal Audit, and Technology teams
• Provide risk-based recommendations to stakeholders and assist in customer/regulatory inquiries
• Participate in governance committees and risk review meetings
• Use GRC tools (OneTrust, Drata, Swiss GRC) and support methodology development
• Develop assessment methodologies, risk scoring models, and reporting frameworks

Key requirements

• Minimum 3 years’ experience in Information Security, Cyber Risk Management, Third-Party Risk Management, Supplier Assurance, or GRC
• Demonstrable experience in third-party security risk programmes in medium to large enterprises
• Experience across multiple jurisdictions (UK, EU)
• Experience reviewing supplier security assessments, due diligence questionnaires, audit reports, and compliance evidence
• Experience supporting security and risk activities related to mergers and acquisitions
• Solid hands-on experience in TPRM, security risk, or GRC
• Ability to independently deliver end-to-end third-party assessments
• Strong understanding of regulatory frameworks (GDPR, ISO 27001, ISO 42001)
• Regular interaction with stakeholders with limited strategic ownership

• Collaborative mindset
• Strong communication
• Stakeholder management
• GRC platforms (OneTrust, Drata, BitSight)
• Power BI and SharePoint for reporting
• Vendor risk assessment methodologies

…