Job Description:

Our client is looking to appoint an IT Governance Analyst to join their IT function. In this role you will conduct IT due diligence on technology suppliers and respond to IT due diligence questionnaires from clients and others. This includes evaluating supplier security, operational resilience, governance and risk management controls, assessing compliance with regulatory and contractual obligations, and identifying technology, cyber, operational and data protection risks. You will also maintain due diligence records and a centralised knowledge base, support supplier on boarding and periodic reviews, and build strong relationships with internal stakeholders and external providers.

Skills/Experience:

• 3-5 year's experience in a similar role with a focus on IT, information security, technology risk or IT audit or in a more operational IT role.
• A solid understanding of third-party supplier risk and technology due diligence, underpinned by knowledge of information security principles and common cyber risks.
• Familiarity with business continuity, disaster recovery and operational resilience principles.
• Experience reviewing and interpreting technical documentation, policies and security controls.
• Ability to identify and assess technology and operational risks and communicate findings clearly to a range of stakeholders.
• Ability to undertake horizon scanning to identify emerging technology, cybersecurity, regulatory and operational risks.
• Strong analytical and problem-solving skills with excellent attention to detail.
• Confident written and verbal communication skills, with the ability to engage with both technical and non-technical stakeholders.
• Well organised, with the ability to manage multiple workstreams and meet deadlines.
• Proactive, inquisitive and keen to develop knowledge of technology risk and governance.
• Proficient in Microsoft Office applications, particularly Excel, Word and PowerPoint.
• Results-focused and client-focused, credible and respected by colleagues at all levels, with the initiative to look ahead and act without being asked, and a structured approach to decision-making.
• Experience completing or supporting due diligence, security and compliance questionnaires would be an advantage.

Core Responsibilities:

• Conduct IT due diligence assessments on prospective and existing third-party technology suppliers.
• Respond to client and other IT due diligence and information security questionnaires.
• Evaluate supplier security, operational resilience, governance and risk management controls.
• Review supplier documentation, including information security policies, ISO 27001 certifications and business continuity/disaster recovery plans.
• Assess third-party compliance with organisational policies, regulatory requirements and contractual obligations.
• Identify technology, cybersecurity, operational and data protection risks associated with third-party providers.
• Support supplier on boarding and periodic supplier review processes.
• Coordinate responses with internal teams to ensure accurate and consistent client communications.
• Maintain due diligence records and evidence to support governance and regulatory requirements.
• Maintain awareness of internal systems, processes and policies, and compile a centralised database/knowledge centre of key responses.
• Contribute to the continuous improvement of third-party risk management processes.
• Build and maintain effective relationships with internal stakeholders and external suppliers to facilitate risk assessments and information gathering.
• Ensure supplier adherence to regulatory standards and internal policies.
• Lead exercises to complete due diligence analysis of service providers, drawing on detailed technical subject matter knowledge, regulatory awareness and skilled relationship management.
• Support on cyber security risk and business continuity tasks.
• Support on the maintenance and drafting of policies and procedures.
• Carry out regulatory horizon scanning to keep abreast of changes that will impact the business.

Core-Asset Consulting is an equal opportunities recruiter and we welcome applications from everyone irrespective of age, disability, gender, gender identity or expression, race, colour, ethnic or national origin, sexual orientation, religion or belief, marital/civil partner status or pregnancy.

To apply for this vacancy applicants must be eligible to work in the UK in accordance with the Immigration, Asylum and Nationality Act 2006.

At Core-Asset, we're committed to protecting and respecting your privacy. Our privacy statement explains when and why we collect personal information about people who engage with our services, how we use it, the conditions under which we may disclose it to others, and how we keep it secure. We may change this policy from time to time, so please check this policy occasionally to ensure that you're happy with any changes.

By engaging with us (either by applying for a job we're advertising, registering through our website, or getting in touch with our business) you're agreeing to be bound by this policy.

Core-Asset Consulting is committed to protecting the privacy of our candidates, clients and website users. For further information, please refer to our full Privacy Statement available on our website http://www.core-asset.co.uk/about-core-asset/privacy-statement

Core-Asset Consulting offers specialist recruitment services to asset management, accounting & finance, asset servicing, legal and the wider financial services sector in Scotland.