Senior IT Security Analyst

Shape the Future with the National Wealth Fund

At the National Wealth Fund, our mission is to swiftly and effectively mobilise trusted sector insights and investment expertise to unlock billions in private finance for projects across the United Kingdom. Providing £27.8bn of capital and an expanded mandate, we are ready to help the market invest with confidence, continue to drive forward the Government's growth ambitions.

We are looking for skilled and results oriented individuals who are motivated to help us build the National Wealth Fund into an industry-leading institution.

Senior IT Security Analyst

Location: Hybrid working with a minimum of 3 days per week in the Leeds office.

Deadline to Apply: 2nd November 2026. Early submission is encouraged, and applications will be reviewed on an ongoing basis.

Purpose of the Role:

The Senior IT Security Analyst will play a key role in the delivery and operation of the National Wealth Fund’s Information Security controls, with a current focus on Microsoft identity, access, data protection and compliance tooling, including Microsoft Entra, Role Based Access Control, Microsoft Purview, Data Loss Prevention, and related user and data security controls. Working as part of the Information Security team, and under the direction of the IT Risk & Security Lead, the role will be responsible for the day-to-day management, improvement and operational effectiveness of these controls within the wider security control framework.

The role will support the Head of Information Security and wider stakeholders in maintaining a secure Microsoft-based IT estate, protecting organisational data, and ensuring that security controls remain practical, proportionate and effective. While overall accountability for Information Security controls and cyber risk reduction remains with the Head of Information Security, the Senior IT Security Analyst will have delegated day-to-day responsibility for the effective operation and delivery of assigned security controls, functions and workstreams. This includes identifying control gaps, supporting remediation, responding to incidents, driving agreed deliverables through to completion, and contributing to the team’s shared responsibility for reducing information security risk.

The accountabilities and examples set out in this job description are intended to describe the main focusareas of the role rather than an exhaustive list of all activity. As part of a small Information Security team, the post-holder will be expected to contribute to wider priorities and emerging requirements where these fall within the role’s capability and the needs of the function.

Key Accountabilities:

Microsoft Security Tooling:

Manage and improve Microsoft security, compliance, user and data protection tooling within assigned workstreams, contributing to control effectiveness, remediation activity and service improvement where required.

Microsoft Purview and Data Protection Controls:

Design, deliver and manage Microsoft Purview, Data Loss Prevention and related information protection controls, supporting data security, governance and compliance across the organisation.

Identity and Access Management:

Lead and support identity governance, access control and RBAC activity across the Joiner-Mover-Leaver lifecycle, including access reviews, control checks and improvement activity.

Risk and Control Assessment:

Identify security risks, vulnerabilities, control gaps and emerging threats within assigned workstreams, supporting proportionate remediation, escalation and risk treatment activity

Incident Response:

Support and coordinate response activity for security incidents where assigned, including investigation, evidence gathering, stakeholder updates, reporting and escalation.

Compliance and Assurance:

Work with Risk, Compliance and other stakeholders to support adherence to relevant laws, regulations, standards and internal policies. Maintain control evidence, undertake spot checks, support audit activity and contribute to remediation of findings.

Training and Awareness:

Support the development and delivery of security awareness activity to help promote secure behaviours and a positive security culture across the organisation.

Stakeholder and Supplier Collaboration:

Develop and maintain effective relationships with internal stakeholders, managed service providers and third parties, providing practical security guidance, challenging outputs where appropriate and supporting process and control improvements.

Reporting:

Prepare and present reports and insights on information security risks, incidents, control effectiveness and remediation activity, proposing recommendations where necessary.

Workstream and Control Support:

Support Information Security activity where it relates to assigned workstreams, user and data security controls, incident response, control operation, evidence, reporting, policy compliance, remediation or escalation.

Threat Awareness and Continuous Improvement:

Maintain awareness of emerging cyber security threats, technology changes and good practice, applying this knowledge to improve controls, processes and operational resilience.

Essential Experience:

• Proven experience in a senior or technically responsible role within an estate which utilises Microsoft technologies such as Microsoft Entra ID, Microsoft 365 and Azure.

• Demonstrable experience and knowledge of implementing, operating or improving controls within Information Security, Data Loss Prevention, Information Security Risk Management and associated areas.

• Demonstrable experience and knowledge of identity management and role based access controls, with the ability to develop and apply deeper capability in Microsoft Entra ID Governance or comparable identity governance tooling.

• Demonstrable experience and knowledge of Microsoft security, compliance or data protection tooling, with experience of Microsoft Purview, Data Loss Prevention or compliance controls being particularly relevant.

• Demonstrable experience of working confidently and effectively with senior stakeholders.

•  Familiarity with recognised security frameworks and standards such as Cyber Essentials Plus, NIST, ISO 27001 or similar.

• Ability to work effectively as part of a team, manage work with minimal supervision and prioritise competing demands.

• Understanding of data protection responsibilities, good practice and how they apply to information security controls.

Desirable Experience:

• Good understanding of relevant regulatory regimes, including UK GDPR and data protection requirements.

• Experience facilitating workshops, reviews or stakeholder sessions.

• Experience working with multiple IT managed service providers or security suppliers.

• Information Security and Risk experience gained within financial services or a regulated environment.

Skills:

• Strong communication, engagement and influencing skills.

• Excellent attention to detail.

• Ability to build constructive relationships with internal stakeholders, suppliers and managed service providers.

• Self motivated, and well organised with initiative, able to manage work independently.

• Comfortable working to agreed objectives, priorities, targets and timescales.

• Able to apply pragmatic, risk based judgement and challenge constructively where required.

A career with us offers a unique opportunity to make a lasting impact and work on cutting-edge technologies that will drive the UK’s future. We value diversity in our people and inclusion is at the heart of what we do.

We offer competitive benefits and unique learning opportunities from combining both private and public sector skills and experience. Please note, referencing and background checks are carried out for all roles here at the National Wealth Fund.