Cyber Security Business Analyst

We are seeking a skilled Cyber Security Business Analyst to enhance vulnerability management, security governance reporting, data quality, and tooling assessments within a global enterprise setting. This role involves consolidating security data from multiple sources, improving the accuracy of reports, coordinating initiatives to enhance ServiceNow CMDB data quality, reviewing vulnerability risk acceptances, and leading market evaluations for vulnerability scanning and aggregation platforms. The successful candidate will have strong analytical and reporting capabilities, business analysis expertise, and excellent stakeholder management skills, alongside a solid understanding of cybersecurity risk and regulatory governance frameworks.

Key Responsibilities

Lead the preparation and delivery of weekly security posture reports, monthly Key Risk Indicators (KRIs), and governance reports for various committees including the Technology Risk Committee (TRC), Information Security Committee (ISC), OpsCom, and Lloyd’s oversight. Consolidate and reconcile data from vulnerability scanning tools, security testing, cloud platforms, and ServiceNow to create a consistent and reliable source of security reporting.

Develop and maintain dashboards using Power BI or equivalent tools, including trend analysis, reporting metrics, and automated reporting processes tailored for senior stakeholders. Validate the accuracy of reports, investigate any data discrepancies, document necessary restatements, and track governance actions to completion.

Collaborate closely with ServiceNow CMDB and IT asset management teams to improve asset ownership, business criticality tagging, CIF tagging, service relationships, and overall security data quality. Reconcile asset inventories across scanning, endpoint detection, cloud, and security testing platforms to identify missing, duplicate, stale, or unscanned assets.

Lead market assessments for vulnerability scanning and aggregation platforms by gathering requirements, evaluating vendors, conducting demonstrations and proofs of concept, performing cost comparisons, and assessing integration capabilities. Prepare business cases, recommendation papers, and transition plans for vulnerability management tooling, considering infrastructure, cloud, containers, application security, and integration with ServiceNow/Jira.

Review vulnerability risk acceptances, exceptions, and waivers to validate justifications, compensating controls, ownership, and expiry dates. Flag outdated or high-risk acceptances for reassessment. Conduct business analysis activities including process mapping, requirements gathering, and stakeholder workshops to identify gaps and recommend improvements in vulnerability management and security governance processes.

Support regulatory, audit, and compliance reporting requirements, including DORA, Lloyd’s Principle 12, remediation Metric 7, and PRA engagements. Work collaboratively with Cyber Defence, IT, Risk, Compliance, Procurement, and security tooling vendors to enhance reporting, operational efficiency, and governance processes.

Required Qualifications

Proven experience in business analysis within cybersecurity, IT risk, information security, or a related enterprise environment. Strong data analysis and reporting skills, including advanced proficiency in Excel and Power BI or equivalent dashboarding tools.

Working knowledge of ServiceNow CMDB, IT asset management, configuration data, and the impact of data quality on security operations. Understanding of vulnerability management concepts, risk-based prioritization, and security scoring methodologies such as CVSS, EPSS, and CISA KEV.

Experience conducting technology market assessments, vendor evaluations, requirements gathering, weighted scoring, business case development, and facilitating stakeholder workshops. Familiarity with risk acceptance, exception management, and governance, risk, and compliance (GRC) processes.

Excellent written and verbal communication skills, with the ability to translate complex technical security risks and data insights into clear, business-focused, and committee-level reporting.

Preferred Qualifications and Benefits

Experience in financial services or insurance sectors is advantageous. Familiarity with vulnerability management tools such as Tenable, Qualys, Rapid7, Vulcan, or Microsoft Defender for Cloud is preferred. Knowledge of regulatory reporting frameworks including DORA, Lloyd’s, and PRA is beneficial.

Experience with CMDB improvement initiatives and reporting automation using Power Query or Python is a plus. Relevant certifications such as CBAP, BCS Business Analysis, ITIL, Security+, or CRISC are highly regarded.

This role offers the opportunity to work at the intersection of cybersecurity, risk management, and business analysis within a dynamic global environment, contributing to the continuous improvement of security governance and vulnerability management practices.