Job Description:

Cyber Assurance & Risk Analyst

Location: London

Salary:  £60,000 per annum

Vacancy Type: Permanent, Full Time

Closing Date: 18th of September 2026

At Imperial War Museums, we're driven by a shared purpose: helping people understand conflict and its impact on people's lives, from the First World War through to the present day. Our collections contain millions of items, stories and digital assets that preserve some of the most important moments in modern history. 

You'll join a collaborative team who work together to protect and make these collections accessible for future generations. It's a unique opportunity to combine cyber security expertise with meaningful work that supports one of the world's leading museums of conflict. 

Why This Role Matters 

Cyber security plays a vital role in protecting IWM's systems, services and information assets from an evolving threat landscape. As Cyber Assurance & Risk Analyst, you'll help strengthen the organisation's cyber resilience by ensuring compliance with government and industry security standards, embedding secure-by-design principles into projects and managing cyber risks across our supplier landscape.  

By delivering key assurance activities, you'll help improve organisational cyber capability and ensure IWM continues to safeguard the services relied upon by colleagues, visitors, researchers and stakeholders. 

What You'll Be Doing 

• Coordinate and manage IWM's Cyber Essentials certification, including evidence gathering, submission management and remediation tracking. 
• Lead GovAssure submissions through control mapping, evidence collation and stakeholder engagement. 
• Manage compliance against Civil Aviation Authority (CAA) cyber security requirements and other relevant standards. 
• Maintain assurance documentation and support continuous compliance against recognised cyber security frameworks. 
• Embed secure-by-design principles into technology and digital projects from initiation through to delivery. 
• Review proposed solutions and provide assurance that appropriate security controls are implemented before go-live. 
• Own and operate IWM's third-party cyber risk management platform, supporting supplier onboarding, assessments and ongoing monitoring. 
• Identify, assess, manage and escalate cyber risks across the supply chain, tracking remediation activities where required. 
• Produce assurance, compliance and cyber risk reports for governance boards and senior stakeholders. 
• Support cyber governance activities, risk management processes and the maintenance of accurate cyber risk records. 
• Contribute to the development of cyber security policies, standards, controls and continuous improvement initiatives. 
• Provide guidance on cyber compliance matters and work collaboratively with colleagues, suppliers and external partners to support assurance objectives. 
• Support financial administration activities, including purchase orders, invoice processing and departmental administration where required. 

What We're Looking For 

We'd love to hear from you if you have: 

• Experience of cyber security governance, assurance, compliance or risk management activities. 
• Knowledge of recognised cyber security frameworks and standards such as Cyber Essentials, NCSC guidance, ISO 27001 or equivalent. 
• Experience managing compliance evidence, audit activities or regulatory submissions. 
• Experience of supplier or third-party cyber risk assessment and management processes. 
• Strong analytical skills with the ability to identify risks and communicate findings clearly to a range of stakeholders. 
• Experience producing reports, dashboards or management information for governance forums and senior audiences. 

Experience of GovAssure, Cyber Essentials Plus, government cyber assurance frameworks, cyber risk management platforms and experience within the public sector, cultural sector or other regulated environments would be advantageous 

How You'll Work 

You'll work collaboratively with the IT & AV Services team, internal teams and external partners to strengthen IWM's cyber resilience, support regulatory compliance and enable secure delivery of digital services. 

What Success Looks Like (First 6-12 Months) 

• Develop a strong understanding of IWM's technology environment, cyber security requirements and organisational priorities. 
• Become a trusted advisor on cyber assurance, compliance and supply chain cyber risk management across the organisation. 
• Independently supporting Cyber Essentials and GovAssure evidence collection activities. 
• Managing supplier onboarding and cyber risk assessment activities through the third-party risk management platform.  
• Embed secure-by-design principles within projects and contribute to stronger cyber governance and resilience across IWM. 
• Build effective relationships with colleagues, suppliers and stakeholders to support the delivery of cyber assurance objectives. 

To Apply

If you feel you are a suitable candidate and would like to work for Imperial War Museum, please click apply to be redirected to our website to complete your application.