The posting
Job Description
Senior Information Security Assurance Specialist
Overview
As a Senior Information Security Assurance Specialist at Arqiva, you'll play a critical role in protecting the services and infrastructure that keep the UK connected.
Working across enterprise IT, cloud platforms, operational technology and third-party environments, you'll provide independent assurance that security controls are appropriately designed, effectively implemented and operating as intended. You'll lead assurance reviews, coordinate audits and certification activities, and provide evidence-based insight that strengthens cyber resilience across the business.
This role combines information security expertise with a strong audit and assurance mindset. You'll assess control effectiveness, challenge existing practices, analyse evidence and identify opportunities for improvement, helping Arqiva demonstrate compliance to customers, regulators, certification bodies and senior stakeholders.
Acting as a trusted advisor and subject matter expert, you'll work across Technology, Legal, Risk and Business teams to ensure security risks are understood, managed and continuously monitored in line with industry best practice and regulatory expectations.
Senior Information Security Assurance Specialist at Arqiva: provide independent assurance, strengthen cyber resilience and help protect critical communications infrastructure relied upon by millions across the UK.
Location
Hybrid working with flexibility to travel to our Winchester and London offices as required.
What's in it for you?
- Up to £95,000 salary
- 10% annual bonus
- Work Life Smarter, our commitment to a flexible and hybrid working culture
- Generous pension scheme starting at 6% and rising to 10%
- A unique wellbeing programme that supports the whole you
- Access to multiple learning platforms to support your development
- Active and diverse colleague networks that build community, support wellbeing and advocate for change
- A comprehensive benefits package, including discounts on major brands, GymFlex memberships and paid volunteering leave
Plus, you'll have the opportunity to influence security assurance across one of the UK's leading media and telecommunications infrastructure businesses, helping safeguard services that underpin broadcasting, critical communications and national connectivity.
Key Accountabilities
- Develop and deliver a risk-based programme of information security assurance reviews, control testing and independent security assessments.
- Assess the design and operating effectiveness of technical, procedural and organisational security controls across Arqiva's technology landscape.
- Lead security assurance reviews across enterprise IT, cloud services, operational technology, critical infrastructure and third-party environments.
- Plan, coordinate and support internal and external audits, certification activities and customer assurance programmes.
- Lead evidence collection, interviews, control walkthroughs, sampling and testing activities, maintaining a robust and defensible audit trail.
- Produce clear and insightful assurance reports that articulate findings, root causes, business impacts and practical recommendations.
- Track audit and assurance findings through to completion, validating that remediation activities are implemented effectively and sustainably.
- Conduct security risk assessments and provide guidance on mitigation activities and risk treatment plans.
- Support incident management activities, remediation efforts and root cause analysis exercises where required.
- Review third-party assurance reports, supplier responses and certification evidence to assess security risks across the supply chain.
- Identify recurring control weaknesses, systemic risks and opportunities to improve security controls, assurance processes and audit readiness.
- Support the implementation and maintenance of information security and cyber security policies and standards.
- Deliver security awareness activities and provide expert guidance to stakeholders across the business.
- Act as a subject matter expert for governance, risk, compliance and assurance-related activities.
- Develop and maintain strong relationships with suppliers, auditors, industry peers and key stakeholders.
- Contribute to budget management, continuous improvement initiatives and the ongoing development of the wider Security GRC function.
What We're Looking For
Essential
- Significant experience in information security assurance, cyber assurance, IT audit, information security governance, risk and compliance, or a related cyber security discipline.
- Proven experience delivering end-to-end assurance reviews, including planning, testing, reporting, remediation tracking and closure.
- Experience assessing both control design and operating effectiveness through evidence-based testing.
- Strong understanding of security governance frameworks, risk management methodologies and assurance practices.
- Experience supporting or leading external audits, certification programmes, customer assurance reviews or regulatory assessments.
- Knowledge of cyber security controls, risk assessment techniques and security best practices.
- Ability to provide independent challenge while building effective working relationships with technical and business stakeholders.
- Strong analytical and problem-solving skills with exceptional attention to detail.
- Excellent written and verbal communication skills, including the ability to communicate complex technical issues to non-technical audiences.
- Experience working collaboratively across technology, security, risk, legal and business functions.
Desirable
- Experience working within telecommunications, critical national infrastructure, technology, utilities or other highly regulated environments.
- Experience assessing security controls within cloud, operational technology and third-party environments.
- Familiarity with customer assurance programmes and supplier security assessments.
- Experience supporting GDPR and broader regulatory compliance initiatives.
- Experience developing assurance methodologies, control testing frameworks and reporting standards.
- Professional certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Auditor or ISO 27001 Lead Implementer.
Skills
- Information Security Assurance
- Cyber Security Governance
- Governance, Risk & Compliance (GRC)
- Security Audit & Assurance
- Control Design & Effectiveness Testing
- Security Risk Assessment
- ISO 27001 & Security Frameworks
- Regulatory Compliance
- Cyber Incident Management
- Root Cause Analysis
- Supplier & Third-Party Assurance
- Stakeholder Engagement & Advisory
- Evidence-Based Testing & Assessment
- Continuous Improvement
- Security Awareness & Training
- Leadership, Coaching & Mentoring
Knowledge & Experience
- Extensive experience in information security assurance, cyber assurance, IT audit, governance, risk management or compliance functions.
- Strong knowledge of information security management frameworks, governance standards and regulatory requirements.
- Practical experience assessing security controls through evidence gathering, interviews, walkthroughs, sampling and testing activities.
- Strong understanding of ISO 27001 and ISO 27002, including control assessment and audit evidence requirements.
- Familiarity with assurance approaches and frameworks such as NIST Cybersecurity Framework, NCSC Cyber Assessment Framework and recognised audit methodologies.
- Experience producing assurance reports and presenting findings and recommendations to senior stakeholders.
- Knowledge of cyber security threats, vulnerabilities and risk mitigation approaches.
- Experience identifying systemic issues, validating remediation activities and driving security improvements.
- Ability to influence decision-making and embed a culture of security assurance and continuous improvement across an organisation.
Qualifications
A degree (or equivalent experience) in Cyber Security, Information Security, Computer Science, Information Systems or a related discipline is advantageous.
Relevant certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Auditor or ISO 27001 Lead Implementer would be beneficial.
Why Arqiva?
We enable a switched-on world to flow. As the UK's leader in TV and radio broadcast and the country's top smart utilities platform, we are shaping the future of connectivity.
Our infrastructure delivers media and data exactly where they're needed, whether that's bringing TV and radio to your home or securely connecting millions of smart meters across the UK. Our technology works quietly behind the scenes, keeping businesses, broadcasters and communities connected every day.
But it's not just what we do, it's how we do it. At Arqiva, you'll find real connection: supportive teams, active colleague networks and opportunities to develop your career in meaningful ways. We'll give you the space and support to grow, whether that's building new skills, exploring different career paths or taking on fresh challenges.
And because there is more to life than work, our rewards and benefits are designed to support your wellbeing, your lifestyle and the things that matter most.
Our Commitment to Diversity & Inclusion
At Arqiva, we're committed to building a workplace where everyone feels valued, heard and empowered to succeed.
We welcome applications from people of all backgrounds and experiences, and we're dedicated to creating an inclusive environment where everyone can thrive. If you require any adjustments at any stage of the recruitment process, please contact [email protected].
If this sounds like the right next step for you, we'd love to hear from you.
#LI-KM1
