Information Security Analyst (GRC)

On-site in London·Full-time·Added 5 days ago (last checked 27 Oct)

Metroline

1 open role

Apply

Our summary

Work mode: On-site, London
Contract: Permanent, full-time hours
Experience: 2+ years

Skills

Requirements

What we're looking for

• At least two years' practical experience in information security, cyber security, GRC or a
related role.
• Working knowledge of common cyber threats, security controls, identity and access
management, endpoint protection and network security.
• Experience supporting vulnerability management, including interpreting scan results, CVEs,
CVSS ratings and OWASP security risks, and tracking remediation.
• Practical experience supporting security risk assessments, control reviews, compliance
monitoring and audit evidence collection.

• Working knowledge of the UK GDPR and Data Protection Act 2018, including data
protection principles, DPIAs, data breaches and data subject rights.
• Awareness of information security risk management, ISO 27001, NIST Cybersecurity
Framework, Cyber Essentials and data protection principles.
• Strong analytical and communication skills, with attention to detail and the ability to
maintain accurate records and escalate risks appropriately.
• Strong organisational and collaborative skills, with the ability to manage multiple priorities
and follow actions through to completion.

Nice to have

• Knowledge of security principles including cloud access controls.
• Experience with phishing investigations, email security, vulnerability remediation or security
awareness campaigns.
• Familiarity with supplier assurance, security questionnaires, risk registers, DPIAs, DPAs,
data-sharing agreements, or audit evidence collection.
• A relevant Information security GRC certification, or evidence of actively working towards
one, is desirable. Relevant qualifications may include ISC2 CGRC, OCEG GRCP, ISACA IT
Risk Fundamentals, ISO/IEC 27001 Foundation, ISO/IEC 27001 Internal Auditor, CRISC or
CISA. Equivalent risk, audit, privacy or compliance qualifications will also be considered.
• Experience in transport, critical services or another operationally complex environment is
desirable.

The role

Job summary :

We are looking for an Information Security Analyst with practical experience to support the
organisation's cyber security governance and risk activities. The role will help identify and
assess security risks, monitor vulnerabilities, maintain security documentation, and work with
stakeholders to improve security controls. The successful candidate will combine sound
technical knowledge with clear communication and a willingness to develop across security
governance, risk, compliance and data protection.

What you'll do

• Vulnerability Management: Support vulnerability scanning, review and validate findings,
track remediation actions with system owners, and escalate overdue or high-risk
vulnerabilities.
• Risk and Compliance: Support information security risk assessments, control reviews,
complete and review DPIAs/ DPAs, and maintain the security risk register. Help collect and
organise evidence for internal and external audits, ISO 27001, Cyber Essentials Plus, PCI
DSS and other assurance activities.
• Policies and Standards: Assist with reviewing and maintaining information security
policies, standards, procedures and guidance. Help monitor compliance and identify areas
requiring improvement.
• Third-Party Security: Support supplier security assessments and due diligence by
reviewing questionnaires and evidence, recording risks, and tracking agreed actions.
• Security Awareness: Help deliver security awareness activities, phishing simulations and
practical guidance for employees. Respond to routine security queries and promote secure
working practices.
• Data Protection Support: Assist with data protection assessments, SARs, and record
keeping in line with UK GDPR, EU GDPR and internal procedures, escalating matters to the
appropriate owner.
• Reporting and Stakeholder Support: Maintain accurate security records, metrics and
dashboards. Communicate technical findings clearly and work with IT, Legal, HR, Service
Delivery and business teams to support remediation.
• Continuous Improvement: Keep knowledge of relevant threats, vulnerabilities and security
practices current, and suggest practical improvements to security controls and processes.

Competencies & Skills

Hours of work :

38 hours per week, Monday to Friday, but must be flexible to work over and above these
hours if deemed necessary.

The Equality Act :

ComfortDelGro is an equal opportunity employer, and all qualified applicants will
receive consideration for employment with due regard to legal obligations for protected
characteristics, i.e. age, disability, marriage and civil partnership, gender reassignment,
pregnancy and maternity, race, religion and belief, sex and sexual orientation.