Information Security Analyst

As an Information Security Analyst at Vitality, you will protect member data and strengthen security controls across the business. You’ll collaborate with cross-functional teams to mature the Information Security Management System and ensure alignment with key standards and regulatory requirements. You’ll identify risks, advise stakeholders, and contribute to a robust security posture through policy development and proactive monitoring. The role offers a hybrid pattern and opportunities to influence security practices at scale.

• Bonus schemes
• Pension up to 12% with 6% matching
• Vitality health insurance
• Life assurance (four times annual salary)

• Provide practical information security guidance to stakeholders across the business
• Support the ongoing development of the Information Security Management System to maintain ISO 27001
• Conduct information security risk assessments across processes, systems, and projects with mitigations
• Perform internal audits against ISO 27001 and prepare evidence-based reports
• Collaborate with project managers to address security risks in the SDLC
• Develop, implement and maintain security policies, standards, and procedures
• Support Data Loss Prevention, access management and monitoring capabilities
• Complete security due diligence on third-party suppliers, including site visits
• Contribute to security training, awareness and broader security improvements
• Assist in investigating security incidents and related audit activities

• Experience in information security roles
• Strong grasp of information security principles, data protection and regulatory compliance
• Experience performing risk assessments and BIA
• Working knowledge of ISO 27001, ISO 27002, PCI DSS and similar frameworks
• Experience developing and implementing security policies and procedures
• Ability to conduct internal audits and produce audit reports
• Experience supporting projects through the software development lifecycle
• Understanding of monitoring tools and technical controls including DLP and RBAC
• Professional qualification such as CISSP, CISA or CRISC, or willingness to pursue one

• Stakeholder communication
• Ability to work with cross-functional teams
• Analytical mindset
• ISO 27001
• ISO 27002
• PCI DSS