Senior Trust Security Analyst
The Senior Trust Analyst — UK Sovereign sits at the intersection of security, sales and customer success, serving as the primary trust and security point of contact for UK Sovereign customers. The role owns responses to customer security inquiries and questionnaires, supports contract reviews covering security and privacy terms, and acts as a trusted adviser on the security posture of UK Sovereign environments.
In addition to traditional Trust Analyst responsibilities, the role serves as the dedicated liaison between UK Sovereign technical security teams and customers. It tracks and reports vulnerability remediation activities in a structured Plan of Action and Milestones (POA&M) format, delivers regular security status updates, and translates complex technical information into clear, customer-ready communications. This is a senior, customer-facing position supporting UK government and regulated-sector customers, accelerating deal cycles and reinforcing the integrity of the UK Sovereign security programme.
Responsibilities include serving as the primary customer contact for security posture, vulnerabilities, remediation activities and trust documentation; supporting end-to-end responses to customer and prospect security questionnaires, including SIG, CAIQ, VSA, MoD, UK government and bespoke enterprise formats; responding to customer security enquiries through email and ticketing; maintaining the public trust centre and UK Sovereign customer-facing documentation; and keeping security whitepapers, certifications and standard responses current.
The role collaborates with UK Sovereign technical and engineering teams to understand and assess the security posture of UK Sovereign environments. It supports vulnerability remediation reporting in POA&M format, documenting vulnerabilities, remediation steps, responsible parties, target completion dates and progress against agreed timelines. It helps prepare and deliver monthly security status updates, monitors remediation activities across engineering and security teams, and ensures alignment with agreed timelines and compliance requirements.
The Senior Trust Analyst interprets third-party audit reports, including SOC 2 Type II, ISO 27001 and penetration-test summaries, and represents findings to customers in questionnaires and security responses. The role gathers detailed technical information from engineering and security teams and converts it into clear, concise and structured updates for technical and non-technical stakeholders. It participates in security review meetings, records feedback and action items, follows up with technical teams, coordinates internal input to validate questionnaire answers, and resolves gaps between stated controls and operational reality.
Applicants must be UK citizens and able to pass and maintain SC clearance. The role requires 5+ years of experience in a security, GRC, trust or technical customer-facing position, including ownership of security questionnaires, customer enquiries and security reporting. Candidates should have hands-on experience with SIG, CAIQ, VSA and bespoke enterprise or government security questionnaires; working knowledge of Cyber Essentials Plus, ISO 27001 and SOC 2 Type II, plus at least one of PCI DSS, GDPR/UK GDPR, HIPAA or FedRAMP; and a strong technical understanding of security principles, architecture and vulnerability management, including access control, encryption, incident response, network security and secure SDLC.
Familiarity with AWS, Azure or GCP and SaaS security models is required, along with exceptional written and verbal communication skills and the ability to explain complex technical controls to procurement, legal, executive and government stakeholders. Candidates should have customer-facing experience in security or technology, ideally with regulated or government customers, and be able to manage a high-volume queue, prioritise work and drive multi-stakeholder responses to deadlines. A relevant bachelor's degree or equivalent practical experience, together with discretion when handling confidential information, is expected.
Cybersecurity certifications such as CISSP, CISM, CISA, CCSK, ISO 27001 Lead Auditor or Security+ are advantageous. Experience with UK Sovereign, MoD or UK government environments, POA&M processes, structured vulnerability remediation reporting and trust portal platforms such as ServiceNow, Whistic, Vanta Trust or Drata Trust is also beneficial. Familiarity with AI/ML security and frameworks such as NIST AI RMF and ISO 42001, previous leadership or line-management experience, resilience in regulated environments, continuous-improvement skills, the ability to learn new technologies and security frameworks, and a collaborative approach across technical, legal, sales and customer-facing teams are desirable. This is an individual-contributor role reporting to the Director, Cloud Information Security and Architecture.