AI Frontier Security Analyst

Within the CISO Offensive Security Tribe, the AI Frontier Senior Security Analyst provides the analytical backbone connecting Frontier AI strategy, cyber risk, target operating model design and delivery. The role translates business, security, operational and regulatory needs into coherent end-to-end processes, precise requirements and delivery-ready artefacts. Working across CISO, Technology, Data & AI, Enterprise Architecture, Operational Resilience, application ownership and control functions, the analyst challenges ambiguity, exposes gaps and dependencies, and maintains traceability from the original need through design, implementation, testing and evidence. The role ensures that programme contributors work from one coherent baseline, with clear scope, ownership, acceptance criteria and measurable outcomes across AI-assisted security assessment and the wider Frontier AI transformation. Key Accountabilities 1. Problem Framing & Requirements
- Clarify business outcomes, risk scenarios, scope boundaries, assumptions, constraints and decision questions before solutioning begins.
- Elicit and reconcile business, functional, non-functional, security, resilience, data and governance requirements.
- Translate approved needs into epics, features, user stories, acceptance criteria and definitions of done.
- Maintain a structured requirements baseline and manage change without losing the original business or risk intent. 2. Process & Operating Model Analysis
- Model end-to-end processes for assessment scoping, preparation, execution, validation, prioritisation, remediation, retesting and closure.
- Document AS-IS workflows and design TO-BE processes using BPMN, ensuring that activities, events, decisions, roles, hand-offs, controls and exceptions are represented consistently.
- Define roles, hand-offs, decision rights, information flows, service boundaries, controls and automation opportunities.
- Translate the target operating model into practical processes, governance, interfaces, service expectations and ownership.
- Identify gaps, duplication and dependencies across people, process, technology and data.
- Supporting RFI/RFP requirements and structured vendor evaluations. 3. Prioritisation & Delivery Enablement
- Support prioritisation using asset criticality, exposure, data sensitivity, known vulnerabilities, technology complexity, feasibility and business impact.
- Facilitate workshops and convert conflicting stakeholder views into clear conclusions, actions and decisions.
- Assimilate large volumes of diverse business, technical, security, operational and regulatory information, identify the underlying narrative and communicate a clear, evidence-based story tailored to the audience.
- Produce process maps, decision papers, requirements, use cases and delivery artefacts that squads can estimate, build and test.
- Support backlog refinement, solution reviews and delivery planning across contributing teams. 4. Traceability, Validation & Assurance
- Link business and regulatory drivers to requirements, controls, features, owners, acceptance criteria, evidence and outcomes.
- Oversee the end-to-end interpretation and practical implementation of security controls, working with assurance teams and delivery stakeholders to clarify intent, resolve ambiguity and connect control design to implementation evidence.
- Support test design, operational readiness and acceptance, confirming that delivered capabilities answer the approved need.
- Maintain traceability across decisions, changes, dependencies and evidence throughout the delivery lifecycle.
- Prepare clear executive summaries and governance-ready material without losing technical or operational meaning. 5. Stakeholder Engagement & Continuous Improvement
- Build effective working relationships across CISO, Technology, business, architecture, resilience and control functions.
- Promote consistent analysis standards, terminology and reusable artefacts across the programme.
- Use delivery feedback and operational evidence to improve requirements, processes and the target operating model.

Your Profile
Qualifications & Experience
- At least 7 years as a Security Analyst in complex technology, cybersecurity, risk or transformation initiatives within major financial institutions or similarly regulated environments.
- Proven expertise in requirements engineering, process modelling, target operating model design, stakeholder facilitation and change control.
- Strong practical experience documenting AS-IS workflows and designing TO-BE processes using BPMN in complex enterprise environments.
- Demonstrated ability to translate complex business and security needs into precise, testable and delivery-ready artefacts.
- Demonstrated ability to synthesise large volumes of varied and sometimes conflicting information, identify the key message and build a clear, compelling and evidence-based narrative.
- Experience maintaining one-to-many traceability across requirements, controls, features, evidence and outcomes.
- Experience overseeing the interpretation and practical implementation of security controls in collaboration with assurance, technology and operational teams.
- Working knowledge of Agile delivery, SDLC governance, operational readiness and transition to business-as-usual.
- Practical experience with application security, vulnerability management, AI-enabled capabilities or offensive-security processes is preferred.
- Experience facilitating multidisciplinary and international stakeholders across business, technology and control functions. Skills & Competencies
- Business analysis, requirements engineering, process and service design, operating-model analysis and acceptance criteria.
- BPMN, AS-IS workflow documentation, TO-BE process design, gap analysis and process optimisation.
- Structured problem-solving, analytical writing, synthesis, workshop facilitation and executive communication.
- Information synthesis, sense-making, data-driven storytelling and communication of complex topics to technical, operational and executive audiences.
- Risk-based prioritisation, regulatory traceability, evidence management and delivery assurance.
- Azure DevOps, ServiceNow, IRM or comparable requirements, delivery and workflow platforms.
- Professional English; French or another European language is an advantage. Behavioural
- Creates structure and shared understanding from complex and ambiguous information.
- Challenges constructively while preserving collaboration and stakeholder trust.
- Works methodically, protects traceability and focuses on usable outcomes rather than documentation volume.