Information Security Third Party Assurance Analyst

About the Company

Responsibilities

• ● An opportunity to play your part We're looking for an Information Security Third Party Assurance Analyst to help keep Centrica, our customers and our colleagues safe by making sure the suppliers we work with meet the right security, privacy and compliance standards. This is a brilliant opportunity to get close to the action across Procurement, Legal, Information Security, Technology GRC and our supplier partners, reviewing assurance activity, spotting potential risks and helping turn complex information into clear, practical decisions. You'll support supplier onboarding, due diligence, reassessments and ongoing assurance throughout the supplier lifecycle, while tracking remediation plans and making sure risks are managed in the right way. If you enjoy connecting the dots, building strong relationships and bringing a bit of calm, clarity and curiosity to the world of third-party security, this role is a great chance to make a real impact at Centrica.
• ● Day to day
• ● Operate the third-party security assessment process for procurement and business requests, making supplier assurance clear, consistent and easy to navigate.
• ● Conduct supplier due diligence assessments by reviewing supplier responses, evidence, assurance reports and supporting documentation against Centrica's information security, privacy, risk and contractual requirements.
• ● Identify, assess and document third-party security, privacy and technology risks, including control gaps, deviations, concessions and remediation actions.
• ● Support supplier onboarding, reassessment and ongoing assurance activity across the supplier lifecycle, with a focus on critical and high-risk suppliers and a strong eye on emerging cyber threats and good practice.
• ● Produce clear, evidence-based risk assessments, reports and recommendations that support business owners, governance forums and risk-based decision making.
• ● Build strong relationships with Procurement, Legal, Privacy, Information Security, Technology GRC, Service Owners, Project Delivery Teams and suppliers, while helping improve assurance processes, documentation and standards.
• ● What are the must haves
• ● Hands-on experience conducting supplier, vendor or third-party security assessments, including reviewing documentation, assurance reports and control evidence.
• ● A solid understanding of information security frameworks and standards such as ISO 27001, NIST, Cyber Essentials and SOC reporting.
• ● Strong analytical, organisational and problem-solving skills, with the ability to spot risks, join the dots and keep assurance activity moving in the right direction.
• ● Confident communication skills, with the ability to explain technical and risk-based information clearly to both technical and non-technical audiences.
• ● What's in it for you
• ● Enjoy a generous market salary, along with fantastic growth opportunities and a vibrant work environment
• ● Power up your pay with a 15% Employee Energy Allowance, surpassing the government's price cap
• ● Secure your future with our comprehensive pension plan, designed for peace of mind.