We are looking for an Information Security Analyst to help us strengthen and maintain our information security posture, support our journey towards security certifications (e.g. ISO 27001, SOC 2), and respond to client security and compliance requirements in a fast‑growing SaaS environment.

Key Responsibilities

• Support the design, implementation and ongoing improvement of the company’s information security management framework, aligned to standards such as ISO 27001, SOC 2 and CIS Controls.
• Assist in preparing, documenting and maintaining policies, procedures and evidence required for security certifications and customer security assessments (e.g. security questionnaires, DPAs, vendor risk assessments).
• Monitor and analyse security events and alerts across our cloud and SaaS environment, perform initial triage, and support incident response and remediation activities.
• Conduct regular vulnerability assessments and coordinate remediation with engineering and infrastructure teams (e.g. patch management, configuration hardening, secure coding follow‑up).
• Support risk assessments on systems, third‑party vendors and changes, documenting risks, controls and mitigation plans in line with our risk management process.
• Maintain security documentation (asset inventories, data flows, access reviews, incident logs, risk registers, exception registers) to ensure our security posture is accurate and audit‑ready.
• Collaborate with Product, Engineering and Operations to embed security by design in new features, deployments and integrations, including basic security reviews of architecture and configurations.
• Assist with client‑facing security and compliance activities, including responding to RFP security sections, due diligence questionnaires, audit requests and contract security schedules.
• Contribute to security awareness and training initiatives for staff, including preparing materials, tracking completion and supporting targeted campaigns based on risk and incidents.
• Prepare and deliver clear security reports, dashboards and metrics tailored to different stakeholders (e.g. management, engineering, clients), highlighting risk, trends and progress on remediation.
• Support external audits or assessments by coordinating evidence, answering queries and tracking follow‑up actions.
• Stay up to date with relevant security threats, vulnerabilities, tools, and best practices in cloud/SaaS environments, and recommend improvements to controls and processes.

Qualifications

• 2-4 Years of Expertise in Cybersecurity and Information Security practices
• Strong understanding of Network Security and Application Security
• Advanced Analytical Skills for evaluating risks and vulnerabilities
• Knowledge of industry security standards, frameworks, and compliance requirements
• Proficiency in implementing and managing security tools and technologies
• Practical experience with at least some of the following: Cloud platforms (e.g. AWS, Azure, GCP) security basics, security tools such as SIEM, EDR, vulnerability scanners, DLP, IDS/IPS or WAF, ticketing and documentation tools (e.g. Jira, github) for tracking security work.
• Relevant certifications such as CISSP, CISM, CISA, or CEH are a plus
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field
• Exposure to information security standards and frameworks (at least one of ISO 27001, SOC 2, NIST CSF, CIS Controls) and familiarity with controls, documentation and audit expectations.
• Experience drafting or maintaining security policies, procedures, runbooks or playbooks.
• Strong problem-solving abilities and the capacity to work independently in a remote role.
• Clear written and verbal communication skills in English, including the ability to document findings and communicate with non‑technical stakeholders.

Preferred / Nice-to-Have

• Experience working remotely with UK, EU or US‑based teams
• Prior involvement in ISO 27001 or SOC 2 readiness, implementation, internal audits or external certification projects.​
• Understanding of data protection requirements (e.g. UK/EU GDPR concepts like technical and organisational measures) and how they relate to security controls in a SaaS environment.
• One or more relevant security certifications such as CompTIA Security+, CEH, SSCP, CC, or equivalent. Higher‑level certifications (e.g. CISSP, CISM) are welcome but not required for this level.
• Knowledge of secure software development practices and common application vulnerabilities (e.g. OWASP Top 10) and experience working with development teams on remediation.