Cyber Risk and Compliance Analyst, Oodle Car Finance

• A minimum of two years' experience in a cyber risk / information security role
• Working knowledge of cyber risk frameworks (e.g. ISO 27001, NIST CSF)
• Hands-on experience with maintaining risk registers and conducting information risk assessments, including supplier risk assessments
• A good understanding of regulatory and compliance requirements such (e.g. PCI-DSS)
• Excellent communication skills, with the ability to articulate technical and risk concepts to diverse stakeholders
• A proactive and structured approach to managing tasks and stakeholders
• A collaborative mindset and a desire to strengthen the organisation’s security posture, in line with our business objectives

Desirable

• Monday – Friday (37.5 hours per week - hybrid)
• Maintain and operate the Cyber Risk Register, ensuring timely tracking and treatment of issues. Provide reporting for key governance committees
• Deliver the Information Risk Assessment Programme, engaging business and technical stakeholders to assess and manage cyber threats and risks
• Deliver Supplier Risk Assessments, working with procurement and business teams to assess and monitor third-party risk through the supplier life-cycle
• Facilitate and document Security Risk Exceptions
• Cyber Training and Awareness: Contribute to the design and rollout of security awareness content and phishing simulation programmes to embed a strong cyber culture
• Security Policy Framework: Support the ongoing development, maintenance, and communication of the organisation’s Security Policy framework, reviewing and updating policies and procedures to ensure alignment with good practice frameworks and business activities
• Cyber Security & Resilience Compliance: Coordinate compliance efforts across standards such as PCI-DSS, external/internal audit requirements, user access reviews, and FCA operational resilience requirements. Work closely with stakeholders to manage remediation actions and audit responses
• Support Cyber Incident Management: Act as a supporting resource in cyber incident response activities, working with security and technical teams to log, track and learn from incidents and near misses

• ☎️ Preliminary Interview (30 mins)
• 📹 Face to Face Interview (1 hr)
• 🏢 Stakeholder Interview (45 mins)