Security Reporting and Governance Analyst

Join the Business Information Security Office (BISO) team as a Security Analyst. The primary purpose of this role is to support the Business Information Security Officer (BISO) by providing reliable data, meaningful management information (MI), and proactive coordination with relevant teams and stakeholders on outstanding queries, tasks and actions. 

Help maintain a clear view of priorities, risks and progress, ensuring the BISO has the accurate and timely information needed to provide effective security oversight and informed business engagement. 

Take ownership of data analysis and leadership reporting, using relevant practical experience to produce meaningful insights and proactively follow up with stakeholders to drive outstanding actions and open items through to resolution. 

Build effective relationships across Security, Technology, Risk, Audit and the Business, gathering and validating information, monitoring commitments and escalating blockers where additional support is required. 

You will bring strong analytical skills and a collaborative approach, with relevant experience in areas such as compliance, risk, governance, audit or cyber security. An understanding of cyber security would be beneficial but is not essential, with curiosity, sound judgement and a willingness to develop being equally important. Deep technical or hands-on engineering expertise is not required 

The Role

BISO Support, Stakeholder Follow-up & Security Governance 

• Support the BISO with data, analysis and meaningful MI to inform cyber security oversight, priorities and engagement with the Risk & Broking business. 
• Build new relationships and nurture established connections with colleagues and departments across the wider ICS and Technology community, supporting collaboration, information sharing and effective follow-up. 
• Proactively follow up with relevant teams and stakeholders on outstanding queries, information requests, tasks and agreed actions, obtaining clear responses and progress updates. 
• Maintain an accurate view of action owners, due dates and progress; clarify incomplete responses and flag overdue items, gaps and blockers to the BISO for attention. 
• Assist with security reviews, governance activities, risk assessments, and business engagement. 
• Prepare materials for governance forums, leadership meetings, and risk committees. 
• Support audit, compliance, and assurance activities where required. 
• Promote cyber security awareness and security best practices throughout the business. 
   

Cyber Security Reporting & Analytics 

• Develop and maintain cyber security and technology risk dashboards, metrics and reporting that turn data into meaningful MI, highlighting risk exposure, control performance and areas requiring attention. 
• Produce executive reporting packs, management information and presentations that explain what the data shows, why it matters and where decisions or follow-up are needed. 
• Analyse data across vulnerabilities, incidents, risks, audits, remediation programmes and control effectiveness, using security knowledge to interpret trends, investigate anomalies and distinguish meaningful signals from noise. 
• Identify emerging themes, areas of concern, and opportunities for improvement. 
• Support regulatory, client, audit, and compliance reporting requirements. 
• Track remediation activities and key actions, providing insight into progress and risk exposure. 
• Create meaningful visualisations and presentations that communicate complex technical information in a clear, concise, and business-focused manner. 
• Suggest and implement practical improvements to reporting, visualisation, automation and management information, working with the BISO and relevant teams. 
• Work with Security, Technology and Risk stakeholders to understand data sources, validate completeness and accuracy, challenge inconsistencies and improve confidence in reporting outcomes. 

Cyber Risk & Vulnerability Management 

• Support the identification, assessment, and management of cyber security risks across the Risk & Broking business. 
• Assist with maintaining risk registers and tracking risk treatment activities. 
• Analyse vulnerability findings and support prioritisation, remediation tracking and reporting, working with technical teams to understand exposure, business context and progress. 
• Monitor and report on security metrics, key risk indicators, and remediation performance. 
• Contribute to initiatives that improve the organisation's overall security posture and reduce cyber risk exposure. 
   

AI & Continuous Improvement 

• Utilise AI tools and technologies to enhance reporting, analysis, research, and operational efficiency. 
• Identify opportunities to automate manual reporting and analytical processes. 
• Contribute to continuous improvement initiatives across cyber security, reporting, and governance activities. 

What you’ll bring

• A personable, dependable team player who builds rapport, listens well and works constructively with colleagues. Able to follow up tactfully on outstanding queries and tasks, keeping the BISO informed of progress and blockers. 
• Relevant practical experience in security, technology risk, reporting, analysis or a related role, with the ability to manage agreed tasks independently, use judgement and recognise when to seek guidance. You do not need to have mastered every area: initiative, ambition and a willingness to build your skills are valued. 
• Strong data analysis and problem-solving skills, with the ability to interrogate information, test assumptions and draw well-supported conclusions. 
• Practical experience using reporting and visualisation tools such as Power BI and Microsoft Excel to analyse data and develop clear, useful reporting. 
• Ability to bring together data from different sources, identify trends and anomalies, and translate findings into meaningful security insights and business implications. 
• Strong reporting, dashboarding and MI skills, with an understanding of how to select useful metrics and tell a clear, evidence-based story rather than simply present data. 
• Excellent written and verbal communication skills. 
• Strong PowerPoint and executive presentation skills. 
• Ability to create high-quality presentations and communicate complex information to a range of audiences. 
• High attention to detail and commitment to data quality. 
• Ability to engage confidently with both technical and non-technical stakeholders. 
• A well-developed understanding of cyber security principles, common threats, security controls and cyber risk management, sufficient to interpret findings and explain their relevance to the business. 
• An appreciation of technical security capabilities and vulnerability management processes: able to understand what security tools and controls do, discuss findings with specialists and recognise their limitations, without needing deep hands-on engineering expertise. 
• Familiarity with AI tools and their application within business and security environments. 

Desirable 

• Experience within Cyber Security, Technology Risk, Governance, Operational Risk, Information Security, or Audit. 
• Experience interpreting data and reporting from vulnerability management platforms such as Rapid7, Qualys, Tenable or Wiz, rather than necessarily administering those platforms. 
• Knowledge of security frameworks such as NIST, ISO 27001, CIS Controls, Cyber Essentials, or SOC 2. 
• Experience using Power BI to develop dashboards and reporting solutions. 
• Exposure to Microsoft Azure or other cloud technologies. 

Personal Attributes 

• Approachable and collaborative, willing to help colleagues and contribute to shared team priorities. 
• Ambitious to develop in cyber security and technology risk, curious about better ways of working and willing to learn from feedback. 
• Strong attention to detail and commitment to quality. 
• Curious, analytical, and solution focused. 
• Self-motivated and reliable, taking ownership of agreed work while sharing progress and seeking support when needed. 
• Strong organisational and time-management skills. 
• Comfortable working in a fast-paced environment with multiple priorities. 

What we offer

Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.

We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you.

Equal Opportunity Employer

We’re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email [email protected].