Arrow Global Group

Purchases and manages non-performing loan portfolios

Group Information Security Risk Analyst

Security Governance, Risk & ComplianceUpdated on Nov 13

Full-timeManchester, UKNo salary listedHybrid

About the Job

Requirements

A degree-level education in Information Security, Cyber Security, Computer Science, Information Systems, Risk Management, or Business Management, or equivalent levels of experience.
At least 5 years of proven experience in Information Security, Cyber Security, IT Risk, or related disciplines.
Strong understanding of Information Security Risk Management principles and methodologies.
Experience conducting risk assessments, control reviews, audits, or assurance activities.
Technical knowledge of information security frameworks and standards, including ISO 27001, NIST Cybersecurity Framework, CIS Controls, DORA, PCI-DSS, and related security practices.
Ability to synthesize complex technical and business information and present findings clearly and concisely.
Effective prioritization and organizational skills, including the ability to manage multiple competing priorities.
Strong analytical and problem-solving skills.
Understanding of cloud technologies and associated information security risks.
Awareness of Artificial Intelligence, associated risks, governance considerations, and emerging industry developments.

Responsibilities

Conduct information security risk assessments across Arrow Global Group and portfolio companies using recognized risk assessment methodologies and frameworks.
Produce risk assessment reports, management summaries, and recommendations for technical and non-technical stakeholders.
Track and monitor remediation actions arising from assessments, audits, incidents, and reviews to ensure timely resolution of identified risks.
Work with stakeholders to ensure recommendations are understood, agreed, and appropriately implemented.
Escalate significant, overdue, or unresolved information security risks through appropriate governance channels.
Support the development, maintenance, and improvement of the Group Information Security Risk Framework.
Assess the effectiveness of information security controls and identify opportunities for improvement.
Apply recognized security frameworks and standards, including ISO 27001, NIST Cybersecurity Framework, CIS Controls, PCI-DSS, and other relevant best practices, proportionately and on a risk-based basis.
Liaise with Cyber Security, IT, Business Continuity, Data Protection, Risk, Compliance, and Internal Audit teams to incorporate security requirements into assessment activities.
Support third-party security assurance, including supplier security reviews, due diligence assessments, and ongoing monitoring of third-party risks.
Prepare metrics, risk dashboards, management information, and committee papers for governance reporting.
Maintain awareness of emerging threats, vulnerabilities, regulatory developments, Artificial Intelligence risks, and industry best practices.

Desired Qualifications

Strong communication, influencing, and interpersonal skills.
Experience producing professional reports and management presentations.

The Group Information Security Risk Analyst will play a key role within Arrow's Group Information Security Function by maintaining the Information Security Risk Framework, delivering high-quality risk assessments and reporting, engaging with stakeholders to drive remediation activities, and ensuring a proportionate and risk-based approach is applied across a diverse range of business sectors.

The role will also support wider Information Security activities including third-party security assurance, due diligence reviews, responses to security questionnaires, audit activities, and security awareness initiatives as required.

Conduct information security risk assessments across Arrow Global Group and portfolio companies using recognised risk assessment methodologies and frameworks.
Produce high-quality risk assessment reports, management summaries, and recommendations for both technical and non-technical stakeholders.
Track and monitor remediation actions arising from assessments, audits, incidents, and reviews, ensuring timely resolution of identified risks.
Work closely with stakeholders to ensure recommendations are understood, agreed, and appropriately implemented.
Escalate significant, overdue, or unresolved information security risks through appropriate governance channels.
Support the ongoing development, maintenance, and improvement of the Group Information Security Risk Framework.
Assess the effectiveness of information security controls and identify opportunities for improvement.
Apply recognised security frameworks and standards including ISO27001, NIST Cybersecurity Framework, CIS Controls, PCI-DSS, and other relevant best practices in a proportionate and risk-based manner.
Liaise with Cyber Security, IT, Business Continuity, Data Protection, Risk, Compliance, and Internal Audit teams to ensure security requirements are appropriately reflected within assessment activities.
Support third-party security assurance activities, including supplier security reviews, due diligence assessments, and ongoing monitoring of third-party risks.
Contribute to governance reporting through the preparation of metrics, risk dashboards, management information, and committee papers.
Maintain awareness of emerging threats, vulnerabilities, regulatory developments, Artificial Intelligence (AI) risks, and industry best practices.

Educated to degree level in Information Security, Cyber Security, Computer Science, Information Systems, Risk Management, Business Management, or equivalent levels of experience.
A minimum of 5 years' proven experience within Information Security, Cyber Security, IT Risk, or related disciplines.
Strong understanding of Information Security Risk Management principles and methodologies.
Experience conducting risk assessments, control reviews, audits, or assurance activities.
Technical knowledge of information security frameworks and standards including ISO27001, NIST Cybersecurity Framework, CIS Controls, DORA, PCI-DSS, and related security practices.
Strong communicator with positive influencing and interpersonal skills.
Ability to synthesise complex technical and business information and present findings in a clear and concise manner.
Effective prioritisation and organisational skills with the ability to manage multiple competing priorities.
Strong analytical and problem-solving skills.
Experience producing professional reports and management presentations.
Understanding of cloud technologies and associated information security risks.
Awareness of Artificial Intelligence (AI), associated risks, governance considerations, and emerging industry developments.

About the Company

Arrow Global Group

Purchases and manages non-performing loan portfolios

Arrow Global Group buys and manages non-performing loan portfolios across Europe. It acquires distressed debt from banks and other lenders, then services and collects on the portfolios to recover value for creditors. The process uses an end-to-end debt management platform for asset acquisition, receivables servicing, analytics, and recovery actions across multiple jurisdictions. Its strategy focuses on a pan-European footprint and growth through acquisitions, with the goal of providing creditors scalable recovery solutions and increasing value through expanded portfolio reach and disciplined execution.

Company size: 501-1,000
Company stage: Debt Financing
Total funding: $400M
Headquarters: Manchester, United Kingdom
Founded: 2005

Recently Posted Jobs

Explore more opportunities at Arrow Global Group

See more jobs