Cybersecurity Business Analyst

Key Outputs

• Approved problem statement, scope, outcomes, and stakeholder map • Current-state and target-state process views

• Business, functional, non-functional, and security requirements • Prioritised backlog, use cases, user stories, and acceptance criteria

• Requirements traceability and change-impact records

• Data definitions, interface needs, and reporting requirements

• Workshop outputs, decisions, assumptions, and action logs

• RFP requirements pack and supplier evaluation inputs
• Test scenarios, UAT support, and acceptance evidence

• Change-impact, readiness, and adoption inputs

• Operational readiness and transition-to-run pack

• Benefits measures and post-implementation review inputs

Zakres obowiązków

• • Lead structured discovery across business, cybersecurity, technology, risk, legal, privacy, procurement, and operations stakeholders. Define the problem, value hypothesis, scope, outcomes, constraints, and measurable acceptance criteria.
• • Elicit, analyse, reconcile, and baseline business, functional, non-functional, security, privacy, regulatory, operational, and reporting requirements. Use interviews, workshops, observation, document analysis, process mapping, and data analysis.
• • Translate cyber risks, threat scenarios, control objectives, and technical constraints into clear business language, decision papers, epics, user stories, use cases, process and data models, traceability matrices, and testable requirements.
• • Own requirements quality and lifecycle, including versioning, prioritisation, change control, impact assessment, and traceability from the original need through design, build, testing, deployment, control evidence, and benefits realisation.
• • Produce or coordinate programme artefacts, including demand inputs, business requirements, product descriptions, current- and future-state processes, stakeholder maps, RACI, data definitions, requirements traceability, acceptance criteria, decision logs, and readiness assessments.
• • Partner with security architects and subject-matter experts to ensure requirements address relevant areas, such as identity and privileged access, infrastructure and cloud protection, application and API security, data protection, vulnerability and exposure management, detection and response, resilience, OT/IoT, third-party risk, and secure operations.
• • Plan and facilitate workshops, playback sessions, design reviews, and sign-off forums. Identify assumptions, conflicts, gaps, and dependencies early, and drive them towards explicit decisions.

Wymagania

• Expertise in requirements elicitation, process analysis, traceability, workshop facilitation, testing, and operational readiness.

• Ability to translate cybersecurity, risk, and technical concepts into business requirements and decisions.

• Experience with RFP requirements, suppliers, global stakeholders, and hybrid delivery.

• Professional proficiency in English.
• Relevant degree or equivalent experience. A recognised role certification is preferred.
• Broad awareness of frameworks such as NIST CSF, ISO 27001, CIS Controls, and ITIL, as well as secure delivery practices, is desirable.

Tech stack

• Business analysis
• Cybersecurity
• Security
• Data analysis
• User stories
• Use cases
• Data models
• Testing
• Cloud
• API
• IoT
• UAT
• Workshop facilitation
• Degree
• NIST
• ISO
• CIS
• ITIL
• IAM
• MFA
• SSO
• Active Directory
• SIEM
• Cloud security
• PKI
• Cryptography
• Audit