CIS3 Business Analyst (Inside IR35) in London

Who are we? Billigence is a boutique data consultancy with global outreach & clientele, transforming the way organizations work with data. We leverage proven, cutting-edge technologies to design, tailor, and implement advanced Business Intelligence solutions with high added value across a wide range of applications from process digitization through to Cloud Data Warehousing, Visualisation, Data Science and Engineering, or Data Governance. Headquartered in Sydney, Australia with offices around the world, we help clients navigate difficult business conditions, remove inefficiencies, and enable scalable adoption of analytics culture.

About the role We are looking for an experienced Business Analyst to help a large enterprise client design and implement an end-to-end compliance operating model that embeds CIS3 controls into business-as-usual (BAU) processes across the application lifecycle. You will join the client’s CIS3 programme, reporting to the CIS3 Programme Manager, analysing existing delivery, governance and operational processes and defining future-state processes so that CIS3 compliance becomes a sustainable BAU responsibility rather than a standalone remediation activity. The work spans new application onboarding, material changes to existing platforms, supplier solutions, governance approvals, operational support and application decommissioning.

Contract: 6–12 months, Inside IR35 Day rate: £550 per day Start: Within 2 weeks, subject to successful background checks Location: Remote (UK-based), with one day a week in the London or Manchester office initially to meet the team, with a view to going fully remote

What you’ll do:

• Run end-to-end reviews of existing business, technology and governance processes, mapping the current state across demand management, architecture, design, procurement, delivery, testing, release, operational support and decommissioning
• Identify decision points, approval gates, stakeholders, artefacts and process dependencies
• Facilitate workshops with business, technology, security, risk and governance teams to capture current ways of working and drive consensus on future-state processes
• Design future-state processes that embed CIS3 controls throughout the application lifecycle with minimal disruption to existing delivery and operations
• Define mandatory stage gates, approval checkpoints and compliance activities, along with exception management and escalation processes
• Work with Security, Data Management, Architecture and Risk teams to map CIS3 controls to lifecycle stages and define control ownership, accountability and evidence requirements
• Develop control matrices linking safeguards to process steps and governance gates, and identify ways to stop non-compliant solutions progressing through delivery
• Support the definition of continuous assurance and periodic review processes
• Define roles, responsibilities and RACI models across business and technology functions
• Analyse governance forums, approval boards and change processes, and recommend enhancements to Design Authority, CAB, Security Governance and Data Governance processes
• Translate complex regulatory and control requirements into practical business processes, and present findings, recommendations and options to programme leadership and governance forums
• Produce key deliverables including current and future-state process maps, gap analysis, control mapping matrices, the target operating model, governance and approval frameworks, RACI matrices, BAU compliance procedures, business requirements, user stories, and tooling integration and automation requirements

What you’ll need:

• Proven experience as a Business Analyst on large-scale transformation, governance, risk, compliance or technology programmes
• Strong process mapping and process design skills, including process flows, swimlane diagrams and control frameworks
• Experience developing Target Operating Models (TOMs)
• A strong understanding of governance, controls and assurance processes
• Experience facilitating workshops and engaging senior stakeholders
• The ability to analyse complex environments and identify opportunities for simplification and standardisation
• Excellent written and verbal communication skills, with experience producing executive-ready documentation and presentations
• Experience on Information Security, Cyber Security or Risk Management programmes is highly desirable
• Knowledge of CIS Controls, NIST, ISO 27001 or related control frameworks is highly desirable
• Exposure to Data Governance, Privacy or Data Protection initiatives, and to application lifecycle management and SDLC processes, is desirable
• Familiarity with tooling such as ServiceNow, Ardoq, Azure DevOps, Jira or Purview is desirable
• Experience in retail or large enterprise environments is desirable

Inclusion and equal opportunities We are always on the lookout for talented individuals to join our team at Billigence. We are an equal-opportunity and inclusive employer and are committed to creating an inclusive environment for all applicants and employees. We will consider all applicants for employment without regard to race, ethnicity, national origin, religion, gender identity or expression, sexual orientation, neurodiversity, disability, age, parental or veteran status.