Cyber Security Business Analyst

About the role

An experienced Cyber Security Business Analyst is sought to support vulnerability management, security governance reporting, data quality and tooling assessments across a global enterprise. The role focuses on consolidating security data, improving reporting accuracy, coordinating ServiceNow CMDB data quality work, reviewing vulnerability risk acceptances and leading market assessments for vulnerability scanning and aggregation platforms.

Key responsibilities

• Prepare weekly security posture reports, monthly KRIs and governance reports for the Technology Risk Committee, Information Security Committee, OpsCom and Lloyd's oversight.
• Consolidate and reconcile data from vulnerability scanners, security testing, cloud platforms and ServiceNow into a reliable reporting source.
• Build and maintain Power BI or equivalent dashboards, trend analysis and automated reporting for senior stakeholders.
• Validate reporting accuracy, investigate discrepancies, document restatements and track governance actions to closure.
• Work with ServiceNow CMDB and IT asset management teams to improve asset ownership, business criticality, CIF tagging and security data quality.
• Reconcile asset inventories across scanning, endpoint detection, cloud and security testing platforms.
• Lead market assessments of vulnerability scanning and aggregation platforms, including vendor evaluations, PoCs, cost comparisons and integration assessments.
• Prepare business cases, recommendation papers and transition plans for vulnerability management tooling.
• Review vulnerability risk acceptances, exceptions and waivers, flagging outdated or high-risk ones for reassessment.
• Conduct business analysis, process mapping, requirements gathering and stakeholder workshops to improve vulnerability management and security governance.
• Support regulatory, audit and compliance reporting such as DORA, Lloyd's Principle 12, Remediation Metric 7 and PRA engagements.
• Collaborate with Cyber Defence, IT, Risk, Compliance, Procurement and security tooling vendors.

Required profile

• Proven business analysis experience in cybersecurity, IT risk, information security or a related enterprise environment.
• Experience in technology market assessments, vendor evaluations, requirements gathering, business cases and stakeholder workshops.
• Knowledge of risk acceptance, exception management and GRC processes.
• Strong written and verbal communication, able to turn technical risks and data insights into clear committee-level reporting.
• Preferred: financial services or insurance experience, regulatory reporting (DORA, Lloyd's, PRA), reporting automation with Power Query or Python, and certifications such as CBAP, BCS Business Analysis, ITIL, Security+ or CRISC.

Required skills

• Advanced Excel and Power BI or equivalent reporting and dashboarding tools.
• Working knowledge of ServiceNow CMDB, IT asset management and configuration data.
• Vulnerability management, risk-based prioritisation and security scoring (CVSS, EPSS, CISA KEV).