Information Security Analyst

This is an exciting opportunity to join Zinc's Information Security team at a pivotal point in its journey. As an Information Security Analyst, you'll play a key role in shaping and strengthening how we approach security across the business, taking ownership of meaningful projects that will have a real impact on our people, products and technology. 💾
You'll have the opportunity to drive improvements, introduce new security practices and work closely with teams across the business to make security a shared priority. It's a hands-on role where you'll have plenty of scope to use your technical expertise, influence how things are done and help build a stronger, more resilient security environment as Zinc continues to grow. 🚀

Key Responsibilities 🗝️

You'll have the opportunity to make a real impact on how Zinc approaches security. Some of your key responsibilities will include:

• 🗺️ Driving the Security Roadmap – take the lead on delivering our 2-year security roadmap, covering everything from workplace identity and cyber attack protection to workforce security, ecosystem resilience and secure software development.
• 🔍 Strengthening Our Security Standards – tackle outstanding audit findings and recommendations, putting the right improvements in place and helping us stay on top of compliance deadlines.
• 🤝 Bringing Teams Along on the Journey – work closely with engineering and other teams across the business to drive security improvements, influence decisions and get everyone moving in the same direction.
• 🛠️ Getting Hands-On – roll up your sleeves and get stuck into the technical work, from implementing new systems to rolling out important security controls.
• 🔐 Building Stronger Identity & Access Management – design, implement or mature IAM controls, including Multi-Factor Authentication (MFA), Joiner-Mover-Leaver (JML) processes and Role-Based Access Control (RBAC).

Skills, Knowledge and Expertise 🚀

You'll need hands-on experience with the following, as these are tools and technologies you'll be working with regularly in the role:

• ☁️ Google Workspace – practical experience managing and securing Google Workspace environments.
  
  
• 🖥️ AWS – experience working with AWS environments and their security.
  
  
• 🔐 MDM (Mobile Device Management) – understanding of device management and endpoint security.
  
  
• 🛡️ EDR (Endpoint Detection and Response) – experience using EDR tools to monitor, detect and respond to threats.
  
  
• 🔎 Threat Intelligence & Vulnerability Management – experience identifying potential threats, assessing vulnerabilities and helping to strengthen security across systems.

These are essential requirements rather than nice-to-haves, as you'll be working directly with these tools and technologies as part of your day-to-day responsibilities.

⭐ Nice-to-Have Experience
It would be a bonus if you also have experience with:

• 🛠️ OWASP SAMM / Secure SDLC maturity models – familiarity with application security frameworks and improving security practices throughout the software development lifecycle.
• 🔑 PIM / PAM Implementation – experience implementing Privileged Identity Management (PIM) or Privileged Access Management (PAM) solutions.
• 🎓 Industry Certifications – qualifications such as CISSP, CISM or CRISC.

These aren't essential, but they'd be a great addition to your experience and help you bring even more to the role!
We're looking for someone who can combine strong technical knowledge with the ability to bring people along with them. The following skills are essential to succeed in this role:

• 🧩 Cross-functional Leadership – ability to work collaboratively across different teams and drive security initiatives throughout the business.
• 💬 Influencing Without Authority – confidence in influencing and gaining buy-in from teams, particularly engineering, even when they don't report directly to you.
• ⚡ Prioritisation Under Pressure – ability to manage competing priorities, balance longer-term security projects with urgent demands and keep things moving.
• 📣 Clear Communication – able to explain technical concepts and security risks in a clear, accessible way to both technical and non-technical stakeholders.
• 💡 Pragmatism – able to balance the ideal security approach with practical business needs, finding solutions that strengthen security without slowing down delivery.

What we offer 🍉

• 24 days holiday + Bank Holidays + your birthday off 🎉
• £1200 annual benefits allowance (ThanksBen, from month 2)
• Early finish Fridays (16:00)
• Yearly company retreat abroad ✈️
• 30 days to Work from anywhere 🌍
• Enhanced Maternity, Paternity, and Adoption Leave (13 weeks full pay, 17 weeks half pay, then SMP for maternity, 1 month full pay for paternity/adoption) 🐣
• Statutory pension with NEST (3% employer, 5% employee)
• Zinc shares, issued through the EMI Scheme
• Unlimited access to Spill Therapy
• Company socials, quarterly team socials Free Monday lunches
• Nursery workplace benefit scheme (Yellownest) 
• Option to lease an electric car through Electric Car Scheme 
• Celebrated Zinc anniversaries 🥳