What are the responsibilities and job description for the Information Security Analyst - GRC & Operations position at WHSmith North America?
As the Information Security Analyst, you will support and secure our current and future cyber infrastructure while playing a key role in our Governance, Risk, and Compliance (GRC) program. This hybrid role blends hands-on security operations with compliance, training, and continuous control assessment responsibilities.
What You'll Do
• Secure the organization's systems and information assets by applying cybersecurity best practices and protecting against unauthorized access, modification, or destruction.
• Partner with end users and department leaders to identify security needs and embed appropriate controls across business units.
• Deploy, integrate, and configure new and existing security solutions in line with standard operating procedures.
• Serve as a Tier 1 responder for cybersecurity alerts and remediations — triage, contain, escalate, document, and investigate problematic or anomalous activity.
• Support vulnerability assessments and penetration testing and coordinate timely remediation of identified weaknesses.
• Administer periodic access reviews to enforce least privilege.
• Support the global cybersecurity compliance program, maintaining alignment with frameworks such as NIST CSF, CIS Controls, ISO 27001, and PCI DSS.
• Perform continuous control assessments, document evidence, identify gaps, and report findings to key stakeholders.
• Maintain the risk register, control catalog, and supporting policies, standards, and procedures; assist with internal/external audits, third-party risk reviews, and ongoing monitoring.
• Deliver corporate cybersecurity training — new-hire onboarding, annual refreshers, role-based training, and phishing simulations.
• Manage training and awareness metrics (completion rates, click/report rates, repeat offenders, behavioral trends), report results to leadership, and coordinate remedial training with HR, IT, and managers.
• Foster a culture of security consciousness across the organization.
What You Bring
• Education: Bachelor of Science in Cybersecurity or a related field, or equivalent hands-on experience.
• Experience: 1–2 years of experience or internships in cybersecurity, IT, or GRC — or a strong academic background with relevant projects, certifications, or lab work.
• Frameworks & standards: Foundational understanding of common cybersecurity frameworks such as NIST CSF, CIS Controls, ISO 27001, or PCI DSS, and an interest in growing into continuous control assessments and compliance work.
• Security operations & EDR: Exposure to endpoint security or EDR tooling and a basic understanding of alert triage, escalation, and incident documentation; willingness to learn Tier 1 response workflows.
• Vulnerability & access management: Familiarity with vulnerability scanning concepts, remediation tracking, user access reviews, and least-privilege principles.
• Risk, policy & audit: Awareness of risk management and policy concepts, with an interest in supporting control assessments, evidence collection, and audit activities.
• Security awareness & training: Interest in helping build and deliver cybersecurity awareness content (onboarding, annual, phishing simulations) and tracking basic training and phishing metrics.