Cyber Security Business Analyst - Water Utilities

The Company Cognizant is a leading provider of information technology, consulting, and business process outsourcing services, dedicated to helping the world's leading companies build stronger businesses. Cognizant has over 340,000 employees as of January 2025.

About Cognizant Consulting: To be digital, companies today must have organizational velocity approaching speed of light while providing individualized offerings that result in fanatical levels of customer satisfaction—all with laser-focused cost control. Our consultants orchestrate the capabilities to truly change the game—across strategy, design, technology and industry/functional knowledge to deliver insight at speed and solutions at scale.

Energy & Utilities Consulting: Energy & utilities in the UK are going through a transformation journey with the focus on making data-centric Asset Investment decisions, enhanced customer experience, sustainable and reliable infrastructure, digitalisation of the aging infrastructure, and disruption from innovative technologies entering the marketplace.

Role Overview: We are seeking a Cyber Security Business Analyst with a strong utilities background to support the delivery of cyber security programmes across our water sector operations. This role acts as the critical bridge between technical cyber security teams, operational stakeholders, and business leadership – translating complex cyber security requirements into actionable project artefacts, process improvements, and business cases.

Key Responsibilities:

• Elicit, document, and manage cyber security business and technical requirements across IT and OT domains.
• Facilitate workshops with stakeholders including control engineers, IT architects, operations managers, and regulators to gather and validate requirements.
• Produce high-quality business analysis artefacts: Business Requirements Documents (BRDs), Functional Specifications, process flow diagrams, user stories, and gap analysis reports.
• Support the development and delivery of cyber security programmes, including NIS compliance, NCSC CAF assessments, and OT security improvement programmes.
• Conduct gap analysis between current-state cyber posture and regulatory/framework requirements (NIST CSF, IEC 62443, NIS Regulations).
• Develop business cases and options appraisals for cyber security investments, quantifying risk reduction and business benefit.
• Manage requirements traceability throughout the project lifecycle, ensuring cyber controls are delivered as specified.
• Support change management activities, ensuring operational teams understand cyber security process and system changes.
• Liaise with technology vendors and system integrators to validate that delivered solutions meet documented requirements.
• Contribute to cyber risk reporting, KPI dashboards, and programme status reporting for senior stakeholders and the Board.

Essential Experience & Skills:

• Proven experience as a Business Analyst on cyber security programmes within utilities or regulated industries.
• Strong understanding of cyber security concepts: risk management, network security, identity and access management, incident response, and compliance.
• Experience working with cyber security frameworks: NIST CSF, ISO 27001, or NCSC CAF.
• Excellent requirements gathering and documentation skills across both IT and OT environments.
• Ability to translate technical cyber security concepts into business language for non-technical stakeholders.
• Experience producing gap analyses, business cases, and options appraisals for cyber security investments.
• Familiarity with GDPR, NIS Regulations, and sector-specific regulatory requirements in the water or energy sector.
• Proficiency in standard BA tooling: Visio/Lucidchart for process mapping, Jira/Azure DevOps for requirements management, Microsoft Office suite.
• Strong facilitation, communication, and stakeholder management skills.

Desirable Experience:

• Direct experience within the water sector (treatment, distribution, wastewater) or equivalent CNI utility.
• Understanding of OT/SCADA environments and the unique challenges of cyber security in operational technology.
• Exposure to OFWAT regulatory processes and capital investment programmes (AMP cycles).
• Experience supporting NIS Regulations compliance assessments or NCSC CAF submissions.
• BCS International Diploma in Business Analysis or equivalent.
• CISMP, CompTIA Security+, or equivalent cyber security qualification.

Qualifications: Degree in Business, Computer Science, Information Systems, or related field (or equivalent experience). BCS, IIBA (CBAP), or equivalent Business Analysis certification desirable. Cyber security awareness qualification (CISMP, Security+, or similar) advantageous.