Cyber Security Business Analyst

About the job

We are looking for an experienced Cyber Security Business Analyst to support vulnerability management, security governance reporting, data quality, and tooling assessments across a global enterprise environment. The role will focus on consolidating security data, improving reporting accuracy, coordinating ServiceNow CMDB data quality initiatives, reviewing vulnerability risk acceptances, and leading market assessments for vulnerability scanning and aggregation platforms. The ideal candidate will possess strong analytical, reporting, business analysis, and stakeholder management skills, with an understanding of cybersecurity risk and regulatory governance.

Responsibilities

• Lead the preparation of weekly security posture reports, monthly Key Risk Indicators (KRIs), and governance reports for the Technology Risk Committee (TRC), Information Security Committee (ISC), OpsCom, and Lloyd’s oversight.
• Consolidate and reconcile data from vulnerability scanning tools, security testing, cloud platforms, and ServiceNow to establish a reliable, consistent source of security reporting.
• Develop and maintain Power BI or equivalent dashboards, trend analysis, reporting metrics, and automated reporting processes for senior stakeholders.
• Validate reporting accuracy, investigate data discrepancies, document restatements, and track governance actions through to closure.
• Liaise with ServiceNow CMDB and IT asset management teams to improve asset ownership, business criticality, CIF tagging, service relationships, and security data quality.
• Reconcile asset inventories across scanning, endpoint detection, cloud, and security testing platforms to identify missing, duplicate, stale, and unscanned assets.
• Lead the market assessment of vulnerability scanning and aggregation platforms, including requirements gathering, vendor evaluations, demonstrations, proofs of concept, cost comparisons, and integration assessments.
• Prepare business cases, recommendation papers, and transition plans for vulnerability management tooling, considering infrastructure, cloud, containers, application security, and ServiceNow/Jira integration.
• Review vulnerability risk acceptances, exceptions, and waivers to validate justifications, compensating controls, ownership, and expiry dates; flag outdated or high-risk acceptances for reassessment.
• Conduct business analysis, process mapping, requirements gathering, and stakeholder workshops to identify process gaps and recommend improvements to vulnerability management and security governance.
• Support regulatory, audit, and compliance reporting requirements, including DORA, Lloyd’s Principle 12, remediation Metric 7, and PRA engagements.
• Collaborate with Cyber Defence, IT, Risk, Compliance, Procurement, and security tooling vendors to improve reporting, operational efficiency, and governance processes.

Requirements

• Proven experience in business analysis within cybersecurity, IT risk, information security, or a related enterprise environment.
• Strong data analysis and reporting skills, including advanced Excel and Power BI or equivalent reporting and dashboarding tools.
• Working knowledge of ServiceNow CMDB, IT asset management, configuration data, and the impact of data quality on security operations.
• Understanding of vulnerability management, risk-based prioritisation, and security scoring methodologies, including CVSS, EPSS, and CISA KEV.
• Experience in technology market assessments, vendor evaluations, requirements gathering, weighted scoring, business cases, and stakeholder workshops.
• Knowledge of risk acceptance, exception management, governance, risk, and compliance (GRC) processes.
• Strong written and verbal communication skills, with the ability to translate technical security risks and data insights into clear business and committee-level reporting.
• Preferred: Financial services or insurance experience, familiarity with Tenable, Qualys, Rapid7, Vulcan, or Microsoft Defender for Cloud, regulatory reporting (DORA, Lloyd’s, PRA), CMDB improvement initiatives, reporting automation using Power Query or Python, and certifications such as CBAP, BCS Business Analysis, ITIL, Security+, or CRISC.