Security Analyst

Key Responsibilities

• Systematically review, prioritise, and clear the backlog of AGAP assessments required across the portfolio of TLSE-owned software products.
• Proactively collaborate with TLSE, Live Services, Hosting Services, the Tech Office, and Software Developers to extract, verify, and consolidate technical security data needed to populate each AGAP.
• Identify, assess and document product architectures, data flows and hosting models, validating alignment with established SbD guidance and escalating issues where required.
• Identify missing security controls, unmitigated risks, assurance gaps or architectural concerns and provide recommendations, escalating findings to relevant stakeholders where required.
• Maintain complete, audit-ready AGAP documentation within central security repositories and track remediation actions to completion.
• Gather insights from the review process to provide constructive feedback to the Tech Office on streamlining SbD workflows and AGAP templates.
• Conduct application assurance reviews.
• Analyse existing assurance documentation and evidence.
• Identify gaps against Secure by Design requirements.
• Work with Service Owners, Product Teams and SMEs to discover, capture and document application, infrastructure, security and operational information where existing documentation is incomplete, outdated or unavailable.
• Gather, analyse and organise evidence required to support AGAP completion, assurance reviews and Secure by Design activities.
• Maintain assurance evidence repositories, track remediation actions and support governance and audit activities.
• Document findings, risks and remediation activities.
• Support tracking and reporting of assurance status across the portfolio.

Must haves

• 3+ years in information security, application security analysis, cybersecurity compliance, or IT risk management within a software development or SaaS environment.
• Practical understanding of Security by Design (SbD) concepts, threat modelling principles, and application security baselines (e.g., OWASP, ISO 27001, NIST).
• Familiarity with modern software development lifecycles (SDLC), cloud hosting platforms (AWS, Azure, or GCP), and production service operations.
• Excellent stakeholder engagement skills with the ability to translate technical conversations with developers and engineers into structured security documentation.
• Methodical mindset with sharp attention to detail, capable of dissecting complex software ecosystems and systematically identifying governance gaps.
• Experience of MOD Secure by Design.
• Cyber assurance and risk management.
• Analysis of technical and security documentation.
• Stakeholder engagement and evidence gathering.
• Production of assurance artefacts and supporting documentation.

Nice to haves

• Relevant industry certifications such as Security+, CISSP, CISA, CRISC, or cloud security badges (e.g., AWS Certified Security Specialty).
• Familiarity with Jira, Confluence, or automated GRC tools used for managing security backlogs and risk registers.
• Prior experience working in an Agile/Scrum software house setup.