Information Security Analyst

About the role

The Information Security Analyst will join idinsight’s Information Security and Systems team, supporting a multicultural, multi‑continental organisation that uses evidence to improve global development programmes. The role is hands‑on, focused on operating security tooling, shaping policy, and reducing risk early in project design.

Key responsibilities

• Administer the security stack (SASE, CASB, EDR, SIEM, MDM), tune policies, investigate alerts and keep tools effective.
• Design and deliver security education, training and awareness programmes, including onboarding modules and phishing simulations.
• Tri­age and investigate security incidents, coordinate containment, maintain the incident response plan and document lessons learned.
• Conduct information‑security risk assessments for projects, systems, vendors and data flows, providing actionable recommendations.
• Respond to due‑diligence requests from funders, partners and clients, maintaining an evidence library for faster replies.
• Develop and maintain security policies, standards and guidelines aligned with recognised frameworks and regulatory obligations.
• Support GDPR and local data‑protection compliance through data mapping, retention, subject‑rights handling and processing‑activity assessments.
• Contribute to governance, risk and compliance activities, including the risk register and assurance processes.
• Assist with AI governance by assessing tools, drafting acceptable‑use guidance and implementing responsible‑use controls.

Required profile

• Hands‑on experience with security tooling and a proactive approach to risk mitigation.
• Ability to write clear, actionable policies and documentation.
• Strong analytical skills for incident investigation and risk assessment.
• Effective communicator who can design and deliver security awareness programmes across multiple offices.

Required skills

• SASE
• CASB (Cloud Access Security Broker)
• EDR (Endpoint Detection & Response)
• SIEM (Security Information & Event Management)
• MDM (Mobile Device Management)
• Phishing simulation tools
• Incident response processes
• Risk assessment methodologies
• GDPR and local data‑protection compliance
• AI governance frameworks