Cyber Risk Consultant in London

As Cyber Assurance & Risk Analyst, you'll play a key role in strengthening IWM's cyber resilience, compliance and third-party risk management. Your work will help ensure cyber risks are identified, managed and reported effectively across the organisation.

As Cyber Assurance & Risk Analyst, you will strengthen IWM's cyber resilience through assurance, compliance and third-party risk management. Working with internal teams and suppliers, you'll help identify, assess and manage cyber risks, support Cyber Essentials and GovAssure compliance activities, and provide governance reporting to senior stakeholders. You'll also help embed secure-by-design principles into technology projects and ensure suppliers meet IWM's cyber security requirements, helping to keep systems, services and information assets secure and resilient.

Job Requirements

• Experience of cyber security governance, assurance, compliance or risk management activities.
• Knowledge of recognised cyber security frameworks and standards such as Cyber Essentials, NCSC guidance, ISO 27001 or equivalent.
• Experience managing compliance evidence, audit activities or regulatory submissions.
• Experience of supplier or third-party cyber risk assessment and management processes.
• Strong analytical skills with the ability to identify risks and communicate findings clearly to a range of stakeholders.
• Experience producing reports, dashboards or management information for governance forums and senior audiences.
• Experience of GovAssure, Cyber Essentials Plus, government cyber assurance frameworks, cyber risk management platforms and experience within the public sector, cultural sector or other regulated environments would be advantageous.

Job Responsibilities

• Coordinate and manage IWM's Cyber Essentials certification, including evidence gathering, submission management and remediation tracking.
• Lead GovAssure submissions through control mapping, evidence collation and stakeholder engagement.
• Manage compliance against Civil Aviation Authority (CAA) cyber security requirements and other relevant standards.
• Maintain assurance documentation and support continuous compliance against recognised cyber security frameworks.
• Embed secure-by-design principles into technology and digital projects from initiation through to delivery.
• Review proposed solutions and provide assurance that appropriate security controls are implemented before go-live.
• Own and operate IWM's third-party cyber risk management platform, supporting supplier onboarding, assessments and ongoing monitoring.
• Identify, assess, manage and escalate cyber risks across the supply chain, tracking remediation activities where required.

About Imperial War Museum: IWM tells the story of people who have lived, fought and died in conflicts involving Britain and the Commonwealth since the First World War. We challenge people to look at conflict from different perspectives, enriching their understanding of the causes, course and consequences of war and its impact on people's lives. Our staff play a crucial role in caring for our unique collections, welcoming our visitors to our five branches and ensuring we continue to preserve and share powerful personal stories.