Cyber Security Business Analyst

We are seeking a seasoned Cyber Security Business Analyst to enhance vulnerability management, security governance reporting, data quality, and tooling assessments within a global enterprise environment. This role involves consolidating security data, improving the accuracy of reports, coordinating ServiceNow CMDB data quality initiatives, reviewing vulnerability risk acceptances, and leading market assessments for vulnerability scanning and aggregation platforms. The ideal candidate will have strong analytical, reporting, business analysis, and stakeholder management skills, along with a solid understanding of cybersecurity risk and regulatory governance frameworks.

Key Responsibilities

Lead the preparation of weekly security posture reports, monthly Key Risk Indicators (KRIs), and governance reports for various oversight committees including the Technology Risk Committee (TRC), Information Security Committee (ISC), OpsCom, and Lloyd’s. Consolidate and reconcile data from multiple sources such as vulnerability scanning tools, security testing, cloud platforms, and ServiceNow to create a reliable and consistent security reporting framework.

Develop and maintain dashboards using Power BI or equivalent tools, including trend analysis, reporting metrics, and automated reporting processes tailored for senior stakeholders. Validate the accuracy of reports by investigating data discrepancies, documenting restatements, and tracking governance actions through to resolution.

Collaborate closely with ServiceNow CMDB and IT asset management teams to enhance asset ownership, business criticality, CIF tagging, service relationships, and overall security data quality. Reconcile asset inventories across scanning, endpoint detection, cloud, and security testing platforms to identify missing, duplicate, stale, or unscanned assets.

Lead market assessments for vulnerability scanning and aggregation platforms by gathering requirements, evaluating vendors, conducting demonstrations and proofs of concept, comparing costs, and assessing integration capabilities. Prepare comprehensive business cases, recommendation papers, and transition plans for vulnerability management tooling, considering infrastructure, cloud, containers, application security, and integration with ServiceNow/Jira.

Review vulnerability risk acceptances, exceptions, and waivers to ensure justifications, compensating controls, ownership, and expiry dates are valid. Highlight outdated or high-risk acceptances for reassessment. Conduct business analysis activities including process mapping, requirements gathering, and stakeholder workshops to identify gaps and recommend improvements in vulnerability management and security governance.

Support regulatory, audit, and compliance reporting requirements such as DORA, Lloyd’s Principle 12, remediation Metric 7, and PRA engagements. Work collaboratively with Cyber Defence, IT, Risk, Compliance, Procurement teams, and security tooling vendors to enhance reporting, operational efficiency, and governance processes.

Required Qualifications

Proven experience in business analysis within cybersecurity, IT risk, information security, or a related enterprise environment. Strong data analysis and reporting skills, including advanced proficiency in Excel and Power BI or equivalent dashboarding tools. Working knowledge of ServiceNow CMDB, IT asset management, configuration data, and understanding the impact of data quality on security operations.

Familiarity with vulnerability management concepts, risk-based prioritization, and security scoring methodologies such as CVSS, EPSS, and CISA KEV. Experience conducting technology market assessments, vendor evaluations, requirements gathering, weighted scoring, business case development, and facilitating stakeholder workshops.

Knowledge of risk acceptance, exception management, and governance, risk, and compliance (GRC) processes. Excellent written and verbal communication skills with the ability to translate complex technical security risks and data insights into clear, business-focused reports suitable for committee-level audiences.

Preferred Qualifications and Benefits

Experience in financial services or insurance sectors is advantageous. Familiarity with vulnerability management tools such as Tenable, Qualys, Rapid7, Vulcan, or Microsoft Defender for Cloud is preferred. Exposure to regulatory reporting frameworks including DORA, Lloyd’s, and PRA is beneficial.

Experience with CMDB improvement initiatives and reporting automation using Power Query or Python is a plus. Relevant certifications such as CBAP, BCS Business Analysis, ITIL, Security+, or CRISC are highly desirable.

This position offers the opportunity to work at the intersection of cybersecurity and business analysis, driving improvements in security posture and governance across a complex, global organization.