Location
London

Hours
Full Time

Salary
Negotiable

About the Role
This is an opportunity to develop one of the foundations of LSEG's future Technology & Cyber Governance, Risk and Compliance model. The role will help build and operate the unified control library and standards capability that defines what good looks like for standard and control owners across Technology and Cyber Security. This is not simply a standards-mapping or library-administration role. The Senior Analyst will own defined components of the control and standards lifecycle, translating regulatory obligations, recognised frameworks, audit lessons and technical requirements into clear standards requirements, control objectives, practical implementation guidance and evidence expectations. Working with Technology and Cyber specialists, the role will challenge gaps, unclear ownership and weak control language so that the framework is usable, traceable and decision-ready. The role will also help modernise how the standards and control library is run, using data, automation and approved artificial intelligence capabilities to improve mapping, quality checks, traceability and reporting while retaining human review and accountability. It offers broad exposure to standard owners, control owners, engineers, Cyber Security specialists, auditors, regulators and risk professionals, and a strong development path into control architecture, standards leadership, technical monitoring or GRC product ownership.

What You'll Be Doing
Maintain and improve assigned areas of the unified Technology & Cyber control library and standards, including taxonomy, objectives, descriptions, ownership, applicability, attributes and evidence expectations. Translate regulatory obligations, industry recognised frameworks and internal policies into clear standards and control requirements; identify gaps, overlaps and duplication and support rationalisation and improvement roadmaps. Draft and refine standards and controls, implementation guidance, evidence requirements and reusable templates that help control owners understand what good control design, operation and evidence look like in practice. Lead the periodic and ad hoc reviews of standards and controls, present at governance forums the changes and prepare approval materials, maintain traceability of decisions and ensure approved changes are communicated to internal customers. Partner control owners, domain specialists, Business Information Security Officers and Technology Risk Officers to challenge control scope, ownership, build quality to track material gaps through remediation. Support Risk and Control Self Assessments (RCSA), audits, regulatory examinations, certifications and other external assessments by providing reliable control mappings, impact analysis, evidence expectations and remediation traceability; the role does not provide an independent assurance opinion. Monitor emerging Technology, Cyber, operational resilience and artificial intelligence requirements. Use analysis, reporting and approved automation or artificial intelligence capabilities to improve control mapping, duplicate detection, data quality, workflow efficiency and management insight, ensuring material outputs remain subject to appropriate human review. Build positive relationships across Technology, Cyber Security, Risk, Audit and the three lines of defence, presenting sophisticated framework and regulatory requirements clearly and constructively challenging where content or evidence is not sufficiently robust.

About LSEG
LSEG is a leading global financial markets infrastructure and data provider. We enable businesses and economies around the world to fund innovation, manage risk and create jobs. Through a broad suite of trusted market infrastructure and data services, we provide the flexibility, stability and trust that enable our customers to pursue their ambitions with confidence and clarity. Our values of Integrity, Partnership, Excellence and Change shape how we think, work and help colleagues fulfil their potential. We embrace diverse backgrounds and perspectives, encourage collaboration and innovation, and create opportunities for people to broaden and deepen their skills through meaningful careers. Working with us means being part of a dynamic organisation of 25,000 people across 65 countries, where individuality is valued and diversity is embraced. We are proud to be an equal opportunities employer committed to sustainability and community engagement through the LSEG Foundation. We offer a range of tailored benefits including healthcare, retirement planning, paid volunteering days and wellbeing initiatives.

Experience
Relevant experience in Technology or Cyber GRC, IT/Cyber Audit, or Risk Management within a complex organisation. Practical experience writing, reviewing or improving control or standards content and mapping requirements to internal obligations, regulatory expectations or industry recognised frameworks. Experience in writing, reviewing and updating Cyber Security standards and guidelines. Demonstrated technical competence with experience implementing and reviewing controls for Identity & Access Management, Perimeter Security, Vulnerability Management, Security Architecture, Security Operations Centre, Cloud Security, Third Party, Change Management, Backup Restoration & Recovery, Incident & Problem Management, Asset Lifecycle Management and Operational Resilience. Solid understanding of recognised frameworks or standards such as the NIST Cybersecurity Framework or Cyber Risk Institute Profile, COBIT, ISO/IEC 27001, SOC 2 or the Information Security Forum Standard of Good Practice. Strong analytical and systems-thinking skills with the ability to identify gaps, duplication, inconsistencies and weak traceability across complex control and standards information.

About You
Ability to build positive relationships across Technology, Cyber Security, Risk, Audit and the three lines of defence. Comfortable presenting sophisticated framework and regulatory requirements clearly and constructively challenging where content or evidence is not sufficiently robust. Interest in using automation and artificial intelligence safely to improve control governance and data quality.

Qualifications
Relevant qualifications or learning pathways such as CISA, CISM, CRISC, CISSP, Security+, ISO/IEC 27001 Lead Implementer or Auditor, or equivalent practical experience are desirable but not mandatory.

Useful
Experience in financial services, financial-market infrastructure or another highly regulated environment, including familiarity with relevant Technology, Cyber or operational resilience regulation. Experience of control-library convergence, rationalisation or redesign, particularly across both Technology and Cyber control domains. Comfort working with GRC platforms, data analysis or visualisation tools.