Security Business Analyst (Ref: 198075)

The Security Business Analyst will define, organise and maintain the requirements that support security delivery across business and technology change initiatives. Acting as the connection between business stakeholders, delivery teams and security specialists, you will convert security objectives, risks and control expectations into requirements that are clear, testable and ready for implementation.

Success in this position will be measured by the quality of requirements, the strength of traceability and the timely resolution of gaps and dependencies. You will provide the structure needed to follow security matters from initial discovery through design, delivery, testing, remediation and assurance, while giving programme leadership an accurate view of progress and outstanding exposure.

The role requires confident stakeholder engagement, disciplined documentation and the ability to interpret technical or security information in a business context. You will support an integrated remediation and delivery approach, ensuring that decisions, ownership, milestones and evidence remain visible throughout the lifecycle.

• Lead the discovery, analysis and documentation of security-related business, functional and technical requirements.
• Convert risk assessments, control objectives and expert security advice into practical requirements for delivery teams.
• Plan and facilitate structured workshops with business owners, architects, engineers, project managers and security specialists.
• Establish clear acceptance criteria so that each requirement can be assessed consistently during design, testing and implementation.
• Maintain complete traceability across risks, controls, requirements, actions, decisions, test outcomes and assurance evidence.
• Review proposed solutions and delivery outputs with subject-matter experts to confirm that security expectations have been addressed.
• Identify ambiguity, omissions, conflicting requirements, delivery dependencies and unresolved ownership issues, escalating them through the appropriate governance route.
• Track remediation activities, milestones, dependencies and accountable owners across the integrated security plan.
• Manage requirement baselines, change records, decision logs, action registers and supporting documentation.
• Monitor evidence submissions and verify that each item is relevant, complete and mapped to the applicable requirement or control.
• Prepare concise status updates, governance packs and management information covering progress, risks, exceptions and upcoming decisions.
• Engage early with project and technology teams to embed security requirements before design and build activity is substantially advanced.
• Support delivery through testing, implementation and post-delivery assurance by keeping requirements and evidence current.
• Contribute to consistent security analysis practices across a complex retail, distribution and marketing services environment.

• Substantial experience as a Business Analyst within information security, technology risk, enterprise transformation or a comparable delivery environment.
• Demonstrable capability in gathering, analysing, documenting, validating and controlling requirements across the full change lifecycle.
• Strong knowledge of requirements traceability, including the ability to connect risks, controls, requirements, acceptance criteria, remediation actions and evidence.
• Practical understanding of information security concepts, technology risks, control design and assurance processes.
• Ability to interpret technical security information and express it in precise language suitable for business stakeholders and delivery teams.
• Proven experience working on complex programmes involving multiple business functions, technology teams, third parties and senior stakeholders.
• Confidence in designing and leading workshops that produce decisions, agreed actions and well-defined requirements.
• Strong analytical judgement, with a structured approach to investigating gaps, testing assumptions and resolving dependencies.
• Experience maintaining high-quality repositories covering requirements, risks, actions, decisions, milestones and assurance evidence.
• Exceptional attention to detail when handling large volumes of interconnected information and time-sensitive delivery activity.
• Clear written and verbal communication skills, including the ability to produce concise reporting for governance forums.
• Experience within SAP, ERP or another large-scale enterprise transformation programme would be beneficial.
• Familiarity with recognised security frameworks, including ISO/IEC 27001 or the NIST Cybersecurity Framework, would be advantageous.
• Experience in retail, distribution, marketing services or another operationally complex commercial sector would be useful.