Security Business Analyst (Ref: 198075)

Role overview

Requirements and delivery responsibilities

• Lead discovery, analysis and documentation of security-related business, functional and technical requirements.
• Convert risk assessments, control objectives and expert security advice into practical delivery requirements.
• Facilitate structured workshops and establish acceptance criteria for design, testing and implementation.
• Maintain traceability across risks, controls, requirements, actions, decisions, test outcomes and assurance evidence.
• Review proposed solutions and delivery outputs with subject-matter experts to confirm security expectations are addressed.
• Identify and escalate ambiguity, omissions, conflicting requirements, dependencies and unresolved ownership.
• Track remediation, milestones, dependencies and owners; maintain baselines, change records, decision logs and action registers.
• Verify evidence submissions are relevant, complete and mapped to requirements or controls.
• Prepare concise governance reporting on progress, risks, exceptions and decisions.
• Engage delivery teams early and support testing, implementation and post-delivery assurance while keeping requirements and evidence current.

Required experience and capabilities

• Substantial Business Analyst experience in information security, technology risk, enterprise transformation or a comparable delivery environment.
• Capability across requirements gathering, analysis, documentation, validation and control throughout the change lifecycle.
• Strong requirements traceability knowledge linking risks, controls, acceptance criteria, remediation and evidence.
• Practical understanding of information security, technology risks, control design and assurance.
• Experience with complex programmes, multiple business and technology functions, third parties and senior stakeholders.
• Workshop facilitation, structured analysis, repository management, attention to detail and clear governance communication.

Preferred experience

• SAP, ERP or another large-scale enterprise transformation programme experience would be beneficial.
• Familiarity with ISO/IEC 27001 or the NIST Cybersecurity Framework is advantageous.
• Experience in retail, distribution, marketing services or another operationally complex commercial sector would be useful.

Work context