Senior Technology Risk Analyst

div class= content-intro p strong WPP is the trusted growth partner for the world’s leading brands. nbsp; /strong /p p strong We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company – powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth. nbsp; /strong br strong nbsp; /strong br strong We work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise. /strong br strong nbsp; /strong br strong Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow. nbsp; /strong br strong nbsp; /strong br strong For more information, visit a href= https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwpp.com%2F amp;data=05%7C02%7CErica.Durr%40wpp.com%7C9bf4566a65bc46a48ac008de749116ea%7C150b5e663d884dee83f6ed149b727a00%7C0%7C0%7C639076363668176216%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C amp;sdata=Q9juosud56XGLThSFZ1NpPZd6FXpJPxV74OeRZWoh%2B4%3D amp;reserved=0 target= _blank WPP.com. /a /strong br strong nbsp; /strong /p /div p nbsp; /p h1 span data-teams= true Senior Technology Risk Analyst /span /h1 ul li strong Department: /strong nbsp;Data amp; Technology Solutions (DTS) /li li strong Reports To: /strong nbsp;SVP Security and Compliance /li li strong Location: /strong [London/Hybrid 2 days a week in office] /li li strong Position Type: /strong nbsp;Full-Time /li /ul hr h3 strong Role Purpose /strong /h3 p The nbsp; strong Senior Technology Risk Analyst /strong nbsp;is responsible for managing and continuously improving the Information Security Management System (ISMS) across Data amp; Technology Solutions. You will ensure that security policies, controls, risks, exceptions, and governance processes are properly maintained, evidenced, reviewed, and acted upon. /p p Reporting to the SVP Security and Compliance, you will provide the operational backbone for security governance across DTS. This is a nbsp; strong hands-on /strong nbsp;Governance, Risk, and Compliance (GRC) role. You will collaborate across security, product, engineering, infrastructure, architecture, legal, risk, compliance, and delivery teams to transform security governance into a dynamic, working management system rather than a static documentation exercise. /p hr h3 strong Key Responsibilities /strong /h3 h4 strong 1. ISMS Ownership amp; Operation /strong /h4 ul li Manage the day-to-day operation and continuous improvement of the DTS ISMS. /li li Maintain the ISMS framework, documentation, control library, policies, standards, and procedures. /li li Ensure the ISMS accurately reflects how DTS operates across products, platforms, infrastructure, data, and engineering. /li li Support alignment with frameworks such as nbsp; strong ISO 27001, SOC 2, GDPR, HIPAA /strong nbsp;(where applicable), and wider WPP security requirements. /li li Ensure ISMS artefacts are version-controlled, approved, reviewed, and communicated appropriately. /li li Maintain clear evidence of security governance activity, control operation, risk treatment, and management reviews. /li /ul h4 strong 2. Policy Management amp; Control Governance /strong /h4 ul li Own the lifecycle of DTS security and compliance policies, standards, procedures, and control documentation. /li li Coordinate policy reviews with Security, Architecture, Infrastructure, Engineering, Product, Legal, Risk, and Enterprise Technology stakeholders. /li li Ensure policies are practical, clear, enforceable, and aligned with DTS's operating reality. /li li Track policy exceptions, waivers, compensating controls, and review dates. /li li Ensure policy changes are communicated and seamlessly embedded into operational processes. /li /ul h4 strong 3. Risk Review Board Operation /strong /h4 ul li Establish and continuously run the nbsp; strong DTS Risk Review Board /strong . /li li Define the Board’s cadence, agenda, inputs, outputs, attendees, and escalation routes. /li li Prepare comprehensive risk packs, dashboards, decision logs, and action trackers. /li li Ensure risks are presented clearly, consistently, and with appropriate supporting evidence. /li li Track decisions, owners, due dates, mitigations, exceptions, and residual risks. /li li Escalate risks exceeding agreed thresholds to the SVP Security and Compliance, DTS leadership, the CISO office, or other appropriate forums. /li /ul h4 strong 4. Risk Register Management /strong /h4 ul li Own and maintain the central DTS security and compliance risk register. /li li Capture, assess, categorise, and maintain security, compliance, privacy, operational resilience, third-party, and technology risks. /li li Ensure all risks have clear descriptions, owners, likelihood/impact ratings, inherent risk scores, mitigations, residual risk scores, treatment plans, and target dates. /li li Partner with risk owners to ensure mitigations are realistic, funded, and actively progressed. /li li Track overdue risk actions and escalate insufficient progress. /li li Produce regular risk reporting for DTS leadership and wider WPP governance forums. /li /ul h4 strong 5. Control Assurance amp; Evidence Management /strong /h4 ul li Support ongoing assurance activity by ensuring controls are consistently evidenced, tested, and reviewed. /li li Maintain control evidence for ISO 27001, SOC 2, client assurance, internal audits, and other compliance needs. /li li Coordinate evidence collection from Engineering, Infrastructure, Security, Product, HR, Legal, and Enterprise Technology. /li li Identify gaps between documented controls and actual operating practices, tracking remediation plans. /li /ul h4 strong 6. Compliance Support amp; Audit Readiness /strong /h4 ul li Support DTS compliance obligations (ISO 27001, SOC 2, HIPAA, GDPR-related controls, and client-specific requirements). /li li Help prepare for internal/external audits, client reviews, security questionnaires, and due diligence exercises. /li li Maintain an organized, always-ready evidence library and audit trail. /li li Support management reviews required by ISO 27001 and other governance frameworks. /li /ul h4 strong 7. Exception, Waiver amp; Remediation Tracking /strong /h4 ul li Manage the formal process for security exceptions, policy waivers, risk acceptances, and remediation plans. /li li Ensure exceptions are documented, reviewed, approved, time-bound, and assigned to accountable owners. /li li Track compensating controls, monitor residual risk, and manage the renewal/escalation of expired exceptions. /li /ul h4 strong 8. Third-Party amp; Supplier Risk Support /strong /h4 ul li Help assess security and compliance risks associated with vendors, partners, tools, platforms, and managed services. /li li Maintain supplier risk records and coordinate with Procurement, Legal, CISO, Enterprise Technology, and Product teams. /li li Ensure third-party risk is appropriately integrated into the DTS risk register and Risk Review Board. /li /ul h4 strong 9. Security Governance Reporting /strong /h4 ul li Produce clear, reliable, and actionable governance dashboards and reports for the SVP Security and Compliance and DTS leadership. /li li Translate complex governance and technical data into clear business language, highlighting trends, overdue actions, and material risks. /li /ul h4 strong 10. Stakeholder Engagement amp; Culture /strong /h4 ul li Foster a collaborative and practical security governance culture across DTS. /li li Coach risk owners on how to describe, assess, treat, and monitor risks. /li li Ensure risk processes support business delivery rather than becoming bureaucratic overhead. /li /ul hr h3 strong Key Accountabilities /strong /h3 p The ISMS and Risk Officer will be directly accountable for: /p ul li Effective operation, accuracy, and maintenance of the DTS Senior Technology Risk Analyst. /li li Continuous, disciplined operation of the DTS Risk Review Board. /li li Up-to-date, approved, and realistic security policies, standards, and control documentation. /li li Structured tracking of risks, exceptions, waivers, and remediation plans. /li li Audit-ready evidence management and reliable governance reporting to leadership. /li /ul hr h3 strong Skills amp; Experience /strong /h3 p strong Required: /strong /p ul li Proven experience in nbsp; strong information security governance, risk management, compliance, audit, or ISMS operation /strong . /li li Strong working knowledge of nbsp; strong ISO 27001 /strong nbsp;and practical ISMS management. /li li Familiarity with nbsp; strong SOC 2, GDPR, HIPAA /strong , cloud security, SaaS platforms, and enterprise security controls. /li li Experience maintaining risk registers, policy frameworks, control libraries, and audit evidence repositories. /li li Experience running or supporting risk committees, governance forums, or control review boards. /li li Excellent technical writing skills (policies, standards, risk statements, and governance reports). /li li Ability to collaborate with technical teams and translate technical issues into business risk/compliance language. /li li Strong organizational skills, high attention to detail, and a constructive yet persistent approach to driving action. /li /ul p strong Preferred: /strong /p ul li Experience operating within a complex, matrixed, enterprise environment is highly valued. /li /ul hr h3 strong Leadership Expectations /strong /h3 ul li strong Disciplined amp; Reliable: /strong nbsp;Bring structure, order, and high standards of documentation to risk and compliance processes. /li li strong Pragmatic amp; Delivery-Aware: /strong nbsp;Build trust with technical teams by making governance useful, proportionate, and aligned with delivery. /li li strong Proactive: /strong nbsp;Follow through persistently on actions, dates, and evidence, and escalate bottlenecks clearly. /li li strong Collaborative: /strong nbsp;Support the SVP Security and Compliance in building a mature, transparent, and well-governed security function. /li /ul hr h3 strong Success Measures /strong /h3 ul li A current, well-maintained DTS ISMS with zero reactive compliance rushes. /li li Security policies and standards reviewed, updated, and communicated on schedule. /li li The Risk Review Board operating systematically with clear actions and high leadership engagement. /li li DTS risk register actively used by leadership to drive risk-based decisions. /li li Audit and certification evidence organized so there are fewer surprises during external audits and client reviews. /li li Security governance fully embedded as a natural part of daily DTS operations. /li /ul p span style= text-decoration: underline; strong Who you are: /strong /span /p p strong You're open em : /em /strong We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working. /p p strong You're optimistic em : /em /strong span id= 628d56ad5d8a35dab853e65d9daa237c class= editor-module-hl-green-solid We believe /span in the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected. /p p strong You're extraordinary: /strong we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day. /p p span style= text-decoration: underline; strong What we'll give you: /strong /span /p p strong Passionate, inspired people /strong – We aim to create a culture in which people can do extraordinary work. /p p strong Scale and opportunity /strong – We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry. /p p strong Challenging and stimulating work /strong – Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge? /p p span style= color: rgb(236, 240, 241); #LI-Hybrid nbsp; /span /p div class= content-conclusion p strong We believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process. /strong /p p strong WPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers. /strong /p h4 strong Please read our Privacy Notice ( a href= https://www.wpp.com/en/careers/wpp-privacy-policy-for-recruitment https://www.wpp.com/en/careers/wpp-privacy-policy-for-recruitment /a ) for more information on how we process the information you provide. /strong /h4 /div Find more English Speaking Jobs in United Kingdom on Arbeitnow