Conduct information security risk assessments, evaluate controls, produce reports and dashboards, track remediation, and escalate unresolved risks. Maintain the Group Information Security Risk Framework and apply ISO 27001, NIST, CIS, PCI DSS, and DORA standards. Support third-party security assurance, supplier due diligence, audits, questionnaires, governance reporting, and security awareness initiatives while collaborating with security, IT, risk, compliance, and audit stakeholders.
The Group Information Security Risk Analyst will play a key role within Arrow's Group Information Security Function by maintaining the Information Security Risk Framework, delivering high-quality risk assessments and reporting, engaging with stakeholders to drive remediation activities, and ensuring a proportionate and risk-based approach is applied across a diverse range of business sectors.
The role will also support wider Information Security activities including third-party security assurance, due diligence reviews, responses to security questionnaires, audit activities, and security awareness initiatives as required.
The role will also support wider Information Security activities including third-party security assurance, due diligence reviews, responses to security questionnaires, audit activities, and security awareness initiatives as required.
About the role
- Conduct information security risk assessments across Arrow Global Group and portfolio companies using recognised risk assessment methodologies and frameworks.
- Produce high-quality risk assessment reports, management summaries, and recommendations for both technical and non-technical stakeholders.
- Track and monitor remediation actions arising from assessments, audits, incidents, and reviews, ensuring timely resolution of identified risks.
- Work closely with stakeholders to ensure recommendations are understood, agreed, and appropriately implemented.
- Escalate significant, overdue, or unresolved information security risks through appropriate governance channels.
- Support the ongoing development, maintenance, and improvement of the Group Information Security Risk Framework.
- Assess the effectiveness of information security controls and identify opportunities for improvement.
- Apply recognised security frameworks and standards including ISO27001, NIST Cybersecurity Framework, CIS Controls, PCI-DSS, and other relevant best practices in a proportionate and risk-based manner.
- Liaise with Cyber Security, IT, Business Continuity, Data Protection, Risk, Compliance, and Internal Audit teams to ensure security requirements are appropriately reflected within assessment activities.
- Support third-party security assurance activities, including supplier security reviews, due diligence assessments, and ongoing monitoring of third-party risks.
- Contribute to governance reporting through the preparation of metrics, risk dashboards, management information, and committee papers.
- Maintain awareness of emerging threats, vulnerabilities, regulatory developments, Artificial Intelligence (AI) risks, and industry best practices.
About you
- Educated to degree level in Information Security, Cyber Security, Computer Science, Information Systems, Risk Management, Business Management, or equivalent levels of experience.
- A minimum of 5 years' proven experience within Information Security, Cyber Security, IT Risk, or related disciplines.
- Strong understanding of Information Security Risk Management principles and methodologies.
- Experience conducting risk assessments, control reviews, audits, or assurance activities.
- Technical knowledge of information security frameworks and standards including ISO27001, NIST Cybersecurity Framework, CIS Controls, DORA, PCI-DSS, and related security practices.
- Strong communicator with positive influencing and interpersonal skills.
- Ability to synthesise complex technical and business information and present findings in a clear and concise manner.
- Effective prioritisation and organisational skills with the ability to manage multiple competing priorities.
- Strong analytical and problem-solving skills.
- Experience producing professional reports and management presentations.
- Understanding of cloud technologies and associated information security risks.
- Awareness of Artificial Intelligence (AI), associated risks, governance considerations, and emerging industry developments.
About
Great talent comes in many forms, and we’re committed to building a diverse and inclusive team. Whilst a number of our roles do require specific qualifications and experience, and industry knowledge, we also value potential, unique perspectives, and transferable skills. If you’re excited about this opportunity but don’t meet every requirement, we’d still love to hear from you. We occasionally collaborate with recruitment agencies to fill niche or specialist roles. However, we do not accept agency terms or pay fees for speculative CVs submitted directly to our hiring managers or outside our Applicant Tracking System. If you are a recruitment agency interested in partnering with us for candidate supply, please reach out to [email protected]
Arrow Global Group London, England Office
London, United Kingdom
Similar Jobs
Cloud • Information Technology • Security • Software • Cybersecurity
Build and maintain high-throughput, low-latency distributed data systems across ingestion, storage, and retrieval. Optimize delivery pipelines, scale analytical database clusters (ClickHouse), develop GraphQL and log delivery solutions, monitor performance with observability tooling, troubleshoot production issues, and collaborate cross-functionally and with open-source communities to evolve the data platform.
Top Skills:
ClickhouseDockerFlinkGoGoGrafanaGraphQLKafkaKubernetesPrometheusSaltSQLTerraform
Cloud • Information Technology • Security • Software • Cybersecurity
Design, build, and operate Cloudflare application security systems, including rate limiting and web application firewall services. Lead complex technical projects, define scalable architectures, improve reliability, review code and designs, collaborate across engineering teams, and mentor other engineers. The role involves distributed systems, production monitoring, debugging, operational improvements, and occasional on-call support.
Top Skills:
C++ClickhouseDockerGoGrafanaGrpcKafkaKubernetesMemcachedPostgresPrometheusRedisRustUnix/Linux
Cloud • Information Technology • Security • Software • Cybersecurity
Leads and scales Cloudflare’s regional or domain-based Customer Engineering organization. Responsibilities include managing managers and multiple teams, owning revenue and commercial targets, shaping go-to-market strategy, coaching technical leaders, improving operational systems with AI, influencing product and cross-functional priorities, and serving as an executive technical sponsor for strategic customers. The role requires extensive technical go-to-market leadership experience, enterprise commercial acumen, executive communication, and fluency in networking, security, performance, or AI platforms.
Top Skills:
Ai WorkflowsBgpBot ManagementCachingCloud PlatformsContent Delivery Networks (Cdn)Ddos MitigationDeveloper ToolingDnsEdge ServicesHttp(S)LlmsSaseSsl/TlsTcp/IpTraffic SteeringWafZero Trust
What you need to know about the London Tech Scene
London isn't just a hub for established businesses; it's also a nursery for innovation. Boasting one of the most recognized fintech ecosystems in Europe, attracting billions in investments each year, London's success has made it a go-to destination for startups looking to make their mark. Top U.K. companies like Hoptin, Moneybox and Marshmallow have already made the city their base — yet fintech is just the beginning. From healthtech to renewable energy to cybersecurity and beyond, the city's startups are breaking new ground across a range of industries.
