Context: 

The Cyber Risk Analyst reports to the Cyber Risk Consultant and is part of the Technology Risk Team, which forms part of the Second Line of Defence in the Non-Financial Risk function. 

The Cyber Risk Analyst will support the Cyber Risk Consultant in providing independent second-line oversight of first-line cyber security across M&G plc. You will be a subject matter expert who: 

• Evaluates, challenges and supports first-line on their Risk and Controls posture, associated testing and remediation.  

• Manages stakeholder engagement and monitors remediation efforts to drive positive outcomes. 

• Provides specialist cyber and technology risk advice to the Non-Financial Risk team and the wider business. 

This role sits within Risk & Compliance and focuses on delivering clear, independent insight to support informed decision-making. 

Key Responsibilities: 

The key responsibilities of this role are to support the delivery of second line cyber risk oversight of first line cyber security. This involves: 

• Providing second-line oversight of first‑line cyber controls, assessing their design, implementation and effectiveness. 

• Review and advise on suitable cyber risk metrics to help maintain risk within appetite. 

• Provide second line review for formal risk processes, RCSAs and assurance actions. 

• Supporting first-line to track and drive remediation of findings from testing, reviews and incidents, ensuring clear remediation plans and closure. 

• Reviewing first-line cyber processes and technical incident responses to identify gaps, root causes and support pragmatic remedial actions. 

• Work with colleagues to provide second line oversight of cyber risk mitigation projects and control improvement initiatives to reduce exposure and provide an accurate assessment of risk.  

• Communicate risk findings and recommendations clearly to stakeholders, enabling timely, informed decision‑making. 

Key Knowledge, Skills & Experience: 

• 3+ years of experience in cyber security or appropriate technology risk function (essential) 

• Well developed stakeholder engagement skills (essential) 

• Broad experience or demonstrable understanding of cyber security domains, such as; risk/audit management, security architecture, DevSec Ops, threat intelligence, vulnerability management and incident response (essential) 

• A willingness to stay up to date with the latest technologies and approaches within Cyber Risk Management (essential) 

• General understanding of second-line activities: risk taxonomy, appetite, KRIs and controls (essential)  

• Curious, analytical and pragmatic problem-solver 

• Experience with reviewing the outputs of red teaming, penetration testing or vulnerability scanning and assessing their significance 

• An awareness and interest in AI and the associated applications 

• Knowledge of enterprise security products and cloud  

• Comfortable with risk/issue tracking tools, risk reviews and clear stakeholder reporting 

• Able to produce gap analyses against policies/standards using industry best practice 

• Excellent report-writing and communication skills 

• Able to work in diverse, multi-cultural teams with international exposure 

Useful Education and Professional Qualifications: 

• Relevant certifications in cyber security, cloud and/or risk