Information Assurance Analyst in Essex, Harlow

Location: Gloucester, South Gloucestershire; Manchester, Lancashire; Harlow, Essex; Livingston, West Lothian; Glenrothes, Fife

Security Clearance Required: SC

Duration: Full time

Hours: 37hrs Dayshift

Benefits:

• Competitive salaries.
• 25 days holiday + statutory public holidays, plus opportunity to buy and sell up to 5 days (37hr)
• Contributory Pension Scheme (up to 10.5% company contribution)
• Company bonus scheme (discretionary).
• 6 times salary 'Life Assurance' with pension.
• Flexible Benefits scheme with extensive salary sacrifice schemes, including Health Cashplan, Dental, and Cycle to Work amongst others.
• Enhanced sick pay.
• Enhanced family friendly policies including enhanced maternity, paternity & shared parental leave.

About the role:

Sitting with the Cyber Security Team, the IT Security Compliance Analyst plays a critical role in ensuring that Raytheon UK remains compliant with a range of internal and external security accreditations, standards and control sets. The Information Assurance Analysts will help to:

• Advise and drive technical security best practices through routine and ad-hoc audit and governance activities.
• Identify areas of noncompliance and risk, ultimately supporting the development of appropriate remediation plans and activities.
• Drive security improvements and uplift across the department through managing post audit remediation plans and actions.

Essential Requirements:

• Practical experience within information security, cyber security, information assurance, IT risk, governance, risk and compliance (GRC), or technology audit.
• Working knowledge of ISO27001, including an understanding of Information Security Management Systems (ISMS), risk-based approaches to security and the assessment of security controls.
• Familiarity with the NIST Cybersecurity Framework (CSF), with an understanding of how security frameworks can be used to assess and improve an organisation's security posture.
• Experience supporting or conducting security audits, compliance assessments, control assessments or assurance reviews.
• Experience identifying and documenting security risks, control deficiencies and non-conformities, and supporting their remediation.
• Ability to analyse security requirements and control evidence and form clear, evidence-based conclusions and recommendations.
• An understanding of common enterprise security controls and technologies, including areas such as identity and access management, vulnerability management, endpoint security, network security, secure configuration, logging and monitoring, data protection and incident management.
• Strong written and verbal communication skills, with the ability to communicate security risks and requirements effectively to technical and non-technical stakeholders.
• Strong analytical, research and problem-solving skills, with excellent attention to detail.
• Ability to build effective working relationships and appropriately challenge stakeholders and control owners when security or compliance requirements are not being met.
• Self-motivated and able to manage and prioritise multiple activities, stakeholders and deadlines with appropriate levels of supervision.
• Ability to obtain and maintain the required UK Security Clearance.

Desirable Requirements:

• Relevant professional qualifications or certifications, or working towards them, such as ISO 27001 Internal Auditor/Lead Auditor, CISSP, CISM, CRISC or equivalent.

Responsibilities:

The Information Security Analyst will support the organisation in maintaining and continually improving its information security and assurance posture. Working as part of the wider Cyber Security team, the role will provide security assurance, risk and compliance support across technology services, systems, applications and business processes.

Main duties and responsibilities include:

• Plan, coordinate and conduct security assessments and assurance reviews across the organisation's infrastructure, applications, services and supporting processes, assessing compliance with internal security requirements, policies and recognised security frameworks.
• Support the organisation's alignment with recognised security standards and frameworks, including ISO27001, the NIST Cybersecurity Framework (CSF), understanding how security controls can be applied and evidenced within a complex enterprise environment.
• Identify security risks, control weaknesses, observations and non-conformities through assessments, audits and day-to-day assurance activities, ensuring these are appropriately documented, assessed, prioritised and tracked through to resolution.
• Assess the design and effectiveness of security controls, gathering and reviewing appropriate evidence and identifying opportunities to improve the organisation's control environment.
• Develop clear, pragmatic remediation recommendations in collaboration with the wider Cyber Security team, service owners, system owners and other stakeholders.
• Provide subject matter expertise and security assurance guidance to service and system owners, helping stakeholders understand security requirements, identified risks and the actions necessary to address control weaknesses or non-compliance.
• Monitor and challenge remediation activity, working with action owners to ensure security findings and risks are addressed appropriately and within agreed timescales, escalating overdue or significant risks where necessary.
• Support internal and external security audits and assessments, including coordinating stakeholders, gathering evidence, responding to audit requests and managing resulting findings and actions.
• Support the planning, coordination and delivery of activities required to maintain Cyber Essentials and Cyber Essentials Plus certification, working with technical and business stakeholders to identify and address potential compliance gaps.
• Ensure that security risks, areas of non-conformity and emerging compliance challenges are identified at the earliest opportunity, working with Cyber Security and relevant business stakeholders to develop proportionate mitigations.
• Ensure significant audit and assessment findings are communicated effectively to relevant stakeholders and, where appropriate, recorded within departmental or organisational risk registers for ongoing ownership and monitoring.
• Produce concise security reports, metrics and management information, communicating technical and compliance issues in a manner appropriate for both technical and non-technical audiences.
• Promote awareness of security assurance and compliance requirements, including planned audits, assessment activity, key commitments, identified control gaps and remediation priorities.
• Contribute to the continual improvement of the organisation's information security management and assurance processes, including policies, standards, control frameworks, assessment methodologies and reporting.
• Maintain awareness of developments in cyber security threats, regulation, industry standards and security good practice, considering their potential impact on the organisation.