Security Compliance Analyst

• →

  Own a portfolio of assigned security control processes end to end: plan them, carry them out, gather evidence, and follow up on and track any findings until they're resolved with clear ownership.

• →

  Perform manual and tool-based security controls, helping us close gaps where controls are missing or not run consistently.

• →

  Carry out regular reviews, such as user access reviews, and make sure results and actions are recorded.

• →

  Run our Third-Party Risk Management (TPRM) process: assessing new and existing suppliers, reviewing their security posture, tracking risks, and scheduling reassessments.

• →

  Maintain the risk registers that keep our security and privacy processes on track (for example supplier, risk, asset, and data processing registers), keeping them accurate and current.

• →

  Help analyse security and privacy requirements in bids and tenders from transport agencies, and work with the wider team to prepare clear, accurate answers.

• →

  Respond to security questionnaires and information requests from existing customers.

• →

  Support audits and certifications (such as ISO 27001, ISO 27017:18, AICPA SOC 2, PCI DSS, NIST CSF and Cyber Essentials) by preparing evidence and documentation.

• →

  Look for opportunities to automate or improve control processes, including with AI tools, so they are faster, more consistent and easier to scale.

• Hands-on experience in information security, IT compliance, internal control or audit, where you’ve owned control processes from start to finish rather than only supporting them

• Practical experience with audits or assessments against at least two recognised frameworks from ISO 27001, SOC 2, PCI DSS, GDPR or NIST, including mapping controls across them

• Solid understanding of access control, risk management, third-party risk and data protection, and of how cloud services and SaaS tools fit together from a security point of view

• Detail-oriented and consistent: you follow a process carefully and don’t let things slip through the cracks

• Clear writing and a knack for structuring information well, whether that’s documentation, registers, or questionnaire answers

• Organised enough to juggle several recurring tasks and deadlines at once

• Comfortable taking ownership of your work, and not afraid to ask questions when something isn’t clear

We don't expect you to tick every box. What matters most is curiosity, a willingness to learn, and the motivation to take ownership of your work.

• Experience with Third-Party Risk Management or vendor security assessments.

• Experience supporting RFPs, tenders or customer security questionnaires.

• Hands-on experience with compliance automation or GRC platforms (for control monitoring, evidence collection and audit management).

• Interest in automation, such as scripting, low-code tools (e.g. n8n, Make) or using AI to improve workflows.

• Experience with Vanta, AWS, Jira or Confluence.

• A relevant certification such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM, CRISC, CISSP or Security+.

• Experience in SaaS, payments or public transport and public sector environments.

// We are a network of innovators from all walks of life, passionate about making a difference. At Masabi, we operate with openness and trust, creating an environment where everyone feels empowered to bring their whole, authentic selves to work.