Security Risk Analyst

Information Security Risk Analyst | Global Investment Manager | London/Hybrid (2-3 days onsite) A global, long-term investment management firm with a strong reputation and a growing technology investment is hiring an Information Security Risk Analyst. The firm treats technology as a real source of investment edge and is modernising its core platform, data and AI capability. This role sits in a small, high-impact Security team, reporting to the Security Manager, with real ownership of how security risk is identified, assessed and communicated across the business. The role

• Run security risk assessments on new systems, changes, projects and emerging technology, including AI tools and integrations
• Own third-party security risk: supplier and cloud due diligence, plus ongoing monitoring
• Assess security controls against ISO 27001 and NIST CSF, and track remediation through to closure
• Maintain the Information Security Risk Register, with clear ownership, treatment plans and escalation
• Produce monthly security KRIs, turning threat, vulnerability and incident data into business risk
• Support security governance: risk forums, senior management reporting, policy exceptions and risk acceptances
• Monitor regulatory requirements (FCA, DORA, GDPR), support audits and respond to client security due diligence What we're looking for
• 5+ years in information security, IT risk, audit or GRC, running risk processes independently
• Hands-on experience maintaining a risk register, assessing controls and tracking remediation
• Solid technical understanding across infrastructure, networks, cloud, identity and applications
• Working knowledge of ISO 27001, NIST CSF or similar, and applying FCA, DORA and GDPR requirements
• Clear communicator who can present findings to both engineers and senior business stakeholders Nice to have: CISM, CRISC, CISSP or ISO 27001 Lead Implementer/Auditor, financial services experience, and exposure to assessing AI risk or using AI to automate risk reporting. Why apply? You'll shape how security risk is understood at a firm where technology is central to the investment edge, present directly to senior management and board-level forums, and help steer the firm's response to DORA. All within a collaborative, intellectually curious culture that offers genuine autonomy, continuous learning, and a strong commitment to work-life balance.