Security Risk Specialist Job in UK | M&S

About Marks & Spencer

Marks & Spencer (M&S) is one of the UK’s leading retailers, recognised for its quality products, customer service and commitment to innovation. The company continues to invest in digital technology and cybersecurity to protect its systems, business operations and customer information. Its Digital & Tech team plays an important role in managing technology risks and ensuring that security remains central to business decisions.

Role Overview

Marks & Spencer is seeking an experienced Security Risk Specialist to join its Digital & Tech team at the London Support Office. The successful candidate will help strengthen the organisation’s cybersecurity posture by implementing risk assessment frameworks, improving governance processes and supporting security risk management across business and technology activities.

The role involves identifying and assessing cybersecurity risks, developing risk reports, supporting the implementation of specialist risk management tools and helping business stakeholders understand potential security threats. The Security Risk Specialist will also work closely with the Governance, Risk & Compliance team and support the development of cybersecurity analysts and associates.

This opportunity is ideal for a cybersecurity professional with strong risk management knowledge, analytical skills and the ability to work with stakeholders across a large organisation.

Key Responsibilities as a Security Risk Specialist

• Support the implementation of the organisation’s cybersecurity risk assessment framework and related processes.
• Help ensure that business systems, technology platforms and sensitive information remain protected against cybersecurity threats.
• Embed cybersecurity risk assessments into business initiatives, technology changes and operational processes.
• Support the review and development of cybersecurity risk appetite statements.
• Implement and configure vendor tools that support cybersecurity risk assessment and reporting.
• Identify, assess and document cybersecurity risks, potential vulnerabilities and their possible business impact.
• Develop clear and comprehensive cybersecurity risk reports for governance committees and senior stakeholders.
• Create risk statements and realistic threat scenarios to help business teams understand security exposure.
• Analyse attacker tactics, techniques and procedures to identify potential threats and understand their root causes.
• Work with the wider Governance, Risk & Compliance team to improve risk management practices and maintain consistent processes.
• Support the development of training materials that help colleagues identify, assess and mitigate cybersecurity risks.
• Coach and mentor Cyber Risk Analysts and Associates, helping them build their skills and achieve their professional development goals.
• Collaborate with technical teams, business stakeholders and risk specialists to support effective security decisions.
• Monitor cybersecurity risk management processes and identify opportunities to improve tools, methods and operational efficiency.

Shift Pattern & Pay

• Salary: Competitive; the exact salary is not specified in the advertised vacancy.
• Job type: Full-time.
• Contract type: Permanent.
• Location: London Support Office, Greater London.
• Working arrangement: Hybrid, with support teams expected to work in the office at least three days per week.
• Closing date: 21 October 2026.
• Reference number: 125214.

Start Your Career With Marks & Spencer

Joining Marks & Spencer offers cybersecurity professionals the opportunity to contribute to the protection of a major UK retailer’s technology systems and business operations. The Security Risk Specialist position combines risk assessment, governance, stakeholder engagement and team development.

Candidates with relevant cybersecurity experience, a strong understanding of recognised risk frameworks and a commitment to continuous improvement can help strengthen organisational resilience while developing their careers in cybersecurity risk management.

Apply Now to become a Security Risk Specialist at Marks & Spencer and help strengthen cybersecurity governance, improve risk assessment processes and protect critical business systems.

How to Apply

Interested candidates should visit the official M&S careers website and submit an online application for the Security Risk Specialist vacancy.

The recruitment process may include an online assessment, followed by a remote or in-person interview covering relevant technical knowledge, cybersecurity risk management experience and professional competencies. Candidates who require reasonable adjustments during recruitment can notify the hiring team when submitting their application.