Information Security Governance and Compliance Analyst

Great journeys start with great people Here at LNER, we're shaping the future of rail on one of the UK's most iconic routes. From our high-speed Azuma fleet, redefining long-distance travel, to our next generation of trains, Serenza, this is a moment of real transformation for LNER. We're investing in cutting-edge technology, sustainability, and most importantly our people, to deliver outstanding experiences for our customers. There has never been a more exciting time to grow your career with LNER! So, what exactly does our Information Security Governance and Compliance Analyst do? LNER is adapting to ensure timely, accurate and focused support to protect against the growing cyber threat the company is facing. Over the next 12 months, the InfoSec team will be involved in several flag ship projects including those specifically coming through the East Cost Digital Programme and the introduction of the new CAF fleet. This is a truly exciting time for InfoSec at LNER. We are therefore pleased to be recruiting for a new Information Security Governance, Risk & Assurance Analyst and are looking for someone with experience in the delivery of risk controls, governance processes, supplier assurances and compliance programmes. We also require a detailed knowledge of current and future legislation within the information security sector for UK rail. The Analyst will provide essential support and input into the InfoSec supplier assurance process, managing the initial review to highlight risk or areas for further investigation. They will also support the risk management framework by reviewing the InfoSec risk register and facilitating the delivery of risk treatment plans within the agreed timescales. This would also extend to activities required to manage the ISO27001 Corrective Actions Log and collation and verification of the Continuous Improvement element of the ISO27001 Standard. This role involves collaboration with all areas of the business to ensure any Information Security requirements in current and future projects is correctly identified and tasks assigned. The role provides cover to facilitate delivery of ECDP Programme by supporting the Information Security team across various projects, both current and upcoming. You'll also be involved in:

• Supporting the LNER Information Security Assurance processes, gaining thorough knowledge of the current processes.
• Guiding critical and key suppliers through the process providing concise, accurate reporting to the Information Security Governance, Risk & Assurance Manager for sign off and to the Information Security Manager as required.
• Managing the treatment tasks/plans identified as requiring remediation through the Information Security Risk Register.
• Working with identified risk owners across the business ensuring the ISO27001 Corrective Actions Log is correct and accurately reflects remediations and agreed delivery.
• Supporting the Information Security Manager and Governance, Risk & Assurance Manager conducting security assessments through vulnerability testing and risk analysis as required.
• Coordinating and supporting surveillance audits in support of maintaining LNER's ISO27001 compliant status.
• Coordinating Information Security Policy review in line with an agreed timetable from the Information Security Compliance Manager.
• Acting as a point of contact for Design Authority papers. Undertaking first review of Technical Impact Assessment papers submitted to Design Authority requiring Information Security review. Supporting business owners completing TIA's and High Level Concept papers completing the relevant sections.
• Developing and carrying out information security plans, policies and procedures.
• Coordinating reporting across the tools used for managing assurance and compliance ensuring reporting is accurate, timely and supports decision making.
• Monitoring use of security products data encryption and other security products and procedures.
• Responding to the business day-to-day information security requests and investigating routine security related incidents such as: malware detections, DLP violations, phishing emails, password compromises, general security information support. What you'll need
• Current experience in an information security role, ideally within risk, governance or assurance.
• Working knowledge of common security controls (e.g. firewalls, endpoint protection, logging and monitoring, access management) and the ability to understand and assess their effectiveness.
• An understanding of core security principles and control domains (access control, encryption, vulnerability and patch management, incident response, business continuity).
• Ability to demonstrate and articulate knowledge of compliance with the ISO27001, PCI DSS, GDPR, NIS Directive, and other security Standards.
• Experience using GRC platforms to manage risk registers, controls and assurance activities.
• Experience identifying, assessing, documenting and tracking information security risks, including agreeing treatment plans and following up on remediation.
• Experience reviewing supplier security questionnaires and evidence (e.g. SOC 2 reports, ISO certificates, penetration test summaries) and making risk-based judgements on their adequacy.
• Recognised industry security certification such as CISMP, CompTIA Security+ or equivalent is desirable.
• Experience in providing written and verbal presentations across all levels of a company.
• Demonstrate their knowledge and understanding of basic financial/technical information.
• You'll be an effective team player, experienced at dealing at all levels with effective influencing and negotiating skills.
• Ability to form constructive and proactive working relationships at all levels with all stakeholders whether internal or external.
• Hands on experience of problem-solving and ability to stay calm under pressure.
• ITIL Foundation certification desirable. You'll enjoy
• Free travel on LNER, plus 75% off other companies' tickets (for you and your dependents).
• Discounted international train tickets (after one year's service).
• 50% discount on LNER tickets for friends and family.
• Generous pension scheme.
• Annual cycle to work schemes/electric vehicle scheme.
• Discount, savings and cashback scheme from top retailers.
• Health and wellbeing schemes and discounts.
• A host of training opportunities to help further your career.
• Rewards and awards to recognise when you shine.