Security Risk Analyst

In this role you will help Nominet understand and manage cyber and information security risk across our infrastructure, services, suppliers and data. You’ll translate complex risk information into clear, actionable guidance and support a risk-aware culture across the business. You will work with cross-functional teams to assess controls, track remediation and ensure appropriate risk treatment. This is an opportunity to contribute to the security and resilience of critical internet infrastructure in the UK.

• Early Finish Friday – 34-hour working week with full-time pay
• 30 days annual leave plus bank holidays, with option to buy 5 more
• Bupa private healthcare + Employee Assistance Programme
• Pension scheme matched to 7%
• Electric vehicle scheme with on-site charging points
• Rewards platform with retailer discounts and offers

• Assess security risks and controls across systems, projects, business areas and suppliers, using established standards (ISO 27001, NIST, CIS Controls, NCSC).
• Identify control gaps and track risk treatment plans, exceptions and remediation with their owners.
• Support supplier security assessments and drive agreed actions to completion.
• Maintain clear records of risks, controls, compliance obligations and assurance activity for visibility.
• Help improve Nominet's security risk approach, policies and standards to keep them clear and proportionate.

• Experience supporting, managing, implementing or auditing security risk, compliance or assurance activities.
• Ability to assess controls and risks, work with owners on practical actions, and maintain auditable records.
• Knowledge of information security standards or guidance (ISO 27001, NIST, CIS Controls or NCSC guidance).
• Understanding of supplier security risk and a broad range of controls (e.g., access management, vulnerability management, incident response).
• Ability to analyse qualitative and quantitative information, explain findings clearly, and work with stakeholders to resolve issues.
• Strong analytical and communication skills, with the ability to maintain accurate records.

• Analytical thinking
• Clear communication
• Stakeholder collaboration
• ISO 27001
• NIST
• CIS Controls