Information Security Analyst – Security Operations & GRC

Information Security Analyst – Security Operations & GRC

Location: UK | Remote

Employment: Permanent/ Fixed Term Employment

Start: ASAP

We’re looking for an experienced Information Security Analyst to join our Information & Cyber Security team, combining hands-on security operations and incident investigation with exposure to governance, risk and compliance (GRC).

This is a varied role where you’ll take ownership of escalated security cases, investigate suspicious activity, work with users and technical teams to establish risk, and drive incidents through to resolution. You’ll also support third-party security assessments, access governance, security controls and compliance activities.

If you enjoy getting beneath the surface of a security alert, understanding what actually happened, and working collaboratively to reach the right outcome, this could be a great next step.

What You’ll Do:

• Security Operations & Investigation
• Triage, investigate and manage escalated security incidents and tickets.
• Analyse suspicious sign-ins, potentially compromised accounts, unusual locations, file-download activity and data-protection events.
• Use available security telemetry and business context to distinguish genuine threats from legitimate activity and false positives.
• Maintain clear investigation notes, evidence and case outcomes.
• Coordinate remediation and ensure incidents are progressed through to resolution.
• Engage directly with users, technology teams, customers and security providers to establish facts and resolve security concerns.
• Governance, Risk & Compliance
• Support GRC, access governance and security-control reviews.
• Manage third-party cyber-security assessments and periodic supplier reassessments.
• Review supplier questionnaires and security evidence, including SOC 2 reports, ISO 27001 certifications and Statements of Applicability.
• Assess supplier cyber risk using RAG-based risk assessments and identify areas requiring further investigation or remediation.
• Support Access Package reviews, evidence gathering, audit activity and management reporting.
• Track outstanding supplier and governance actions through to completion.
• Security Monitoring & Continuous Improvement
• Work with Microsoft security technologies and other security platforms to investigate events and validate controls.
• Support security controls across identity, access, data protection and cloud activity.
• Work with external security service providers on investigations and escalations.
• Identify recurring false positives, detection gaps and operational issues.
• Recommend improvements to monitoring, escalation and incident-management processes.

What You’ll Bring:

We’re looking for someone with:

• Experience in Information Security, Cyber Security Operations or Security Incident Management.
• Strong security triage, investigation and analytical skills.
• Experience managing security incidents through investigation to resolution.
• Understanding of Identity & Access Management (IAM) and access governance.
• Exposure to GRC, third-party/supplier risk or security assurance.
• Familiarity with security evidence such as ISO 27001 and SOC 2.
• Experience working with Microsoft security technologies or similar enterprise security platforms.
• Strong documentation and audit-support skills.
• Confidence communicating security issues clearly to both technical and non-technical stakeholders.
• A proactive mindset and willingness to take ownership rather than simply passing incidents between teams.

Why This Role?

This is an excellent opportunity for someone looking to broaden their cyber-security experience beyond a traditional monitoring role. You’ll gain exposure across Security Operations, incident response, IAM, GRC, supplier risk and security assurance, while working on real security challenges in an international environment.

If you’re naturally curious, enjoy investigating security events and want a role where you can make an impact across both operational security and cyber risk, we’d like to hear from you.

Apply today and take the next step in your cyber-security career.

#UST #CyberProof

Key skills:

Security Operations | Incident Triage | Cyber Security | GRC | IAM | Third-Party Risk | Security Assurance | ISO 27001 | SOC 2 | Audit Support | Access Governance | Incident Investigation