Cyber Controls Manager

Sizewell C; Greater London; Hybrid; GBP 82,000 - 84,000; Full time

Benefits offered by this job

Annual leave 28 days

5% annual bonus

Pension contributions up to 22.5%

Life assurance

Job summary

Sizewell C is recruiting a Cyber Controls Manager to own and maintain the organisation's cyber security controls framework, ensuring auditable traceability between risks, requirements and controls. You will lead the Cyber Controls Specialist and work with cyber, digital, assurance and programme teams to strengthen cyber governance and resilience.

You will report to the CISO, oversee control design, monitoring and evidence collection, and help align controls with regulatory obligations and

Qualifications

• Degree or equivalent in Cyber Security, Information Security, Computer Science or related discipline.
• Minimum five years in cyber security with at least three years in controls/assurance.
• Experience presenting to senior stakeholders and governance forums.

Responsibilities

• Own and maintain the cyber security controls framework and taxonomy.
• Ensure controls are documented with ownership, status, risks and evidence.
• Lead and direct the Cyber Controls Specialist and collaborate with cyber, digital and assurance teams.
• Provide governance, reporting and stakeholder engagement on control effectiveness and remediation.

Skills

Leadership

Stakeholder management

Cyber security

Governance

Communication

Education

Degree in Cyber Security/Information Security/Computer Science

Tools

GRC platforms

Penetration testing

Vulnerability management

Job description

Sizewell C is entering an exciting phase of growth as we mature into an independent organisation and continue building one of the UK's largest and most important energy projects. We are now recruiting the below position:

Position: Cyber Controls Manager

Security Clearance: Active Security Clearance is required and must already be in place

Location:London, Leiston or Ipswich, with hybrid working and a minimum of 2 days per week on-site. Travel to other Sizewell C locations may be required.

Contract: Permanent, full-time

Salary: £82,200 - £84,000 depending on experience, plus benefits

Benefits include:

• Annual Leave: 28 days per annum, increasing to 30 days after 5 years of service, plus bank holidays
• Bonus:5% annual bonus
• Pension Contributions: Defined Contribution Pension Scheme with up to 7.5% employee contribution 15% employer contribution
• Life Assurance: Up to 8 x salary

Closing Date: 1st October 2026

About the Role:

The Cyber Controls Manager plays a pivotal role in ensuring Sizewell C's cyber security controls are effective, auditable and aligned to organisational, regulatory and business requirements.

Reporting directly to the Chief Information Security Officer (CISO), you will own and manage the organisation's cyber security controls framework, maintaining clear traceability between cyber risks, regulatory obligations and the controls implemented to mitigate them. Acting as the bridge between risk identification and risk treatment, you will ensure controls are appropriately designed, documented, monitored and evidenced.

The role also provides leadership to the Cyber Controls Specialist and works closely with cyber, digital, assurance and programme delivery teams to strengthen the organisation's cyber resilience and governance arrangements.

Key Responsibilities:

Cyber Controls Framework

• Own and maintain the organisation's cyber security controls library, ensuring it remains comprehensive, structured and audit ready.
• Define and maintain the controls taxonomy, categorising controls by domain and control type.
• Ensure controls are documented consistently, including ownership, implementation status, associated risks, supporting requirements and effectiveness evidence.
• Maintain alignment between controls, regulatory obligations, contractual requirements and recognised cyber security frameworks.
• Establish robust governance and change management processes to support the continual improvement of the control's framework.

Cyber Risk & Controls Design

• Work closely with the Cyber Risk Manager to ensure controls are identified, assessed and mapped against new and existing cyber risks.
• Maintain end-to-end traceability between cyber risks, regulatory requirements and implemented controls.
• Define control objectives and collaborate with technical teams to develop implementation guidance, testing criteria and evidence requirements.
• Support the continuous enhancement of the control environment in response to emerging threats, incidents, audits and lessons learned.
• Provide leadership and direction to the Cyber Controls Specialist, ensuring the effective delivery of cyber controls management activities.

Controls Monitoring & Assurance

• Support compliance and regulatory activities by providing control evidence and demonstrating control effectiveness.
• Collaborate with assurance teams to align control monitoring activities with assurance programmes and remediation plans.
• Monitor control performance, identifying weaknesses, gaps or degraded controls and recommending corrective action.
• Evaluate control effectiveness against current and emerging cyber threats.
• Track the outcomes of control testing activities, including penetration testing, vulnerability assessments and security exercises, ensuring identified actions are progressed to completion.

Governance, Reporting & Stakeholder Engagement

• Attend governance forums and provide updates on control effectiveness, control coverage, remediation activities and emerging risks.
• Advise stakeholders on appropriate control selection and implementation in support of risk treatment activities.
• Prepare reports and dashboards for the CISO and senior leadership, communicating technical information in a clear and accessible manner.
• Maintain governance records, testing evidence and supporting documentation to an auditable standard.
• Work with programme and project teams to ensure security controls are embedded throughout the system lifecycle and considered within governance processes from the outset.

Knowledge & Skills:

• Strong understanding of cyber security control frameworks, including ISO 27001, and the principles of control design, implementation, assessment and governance.
• Ability to develop and maintain risk-to-control and requirement-to-control mappings, providing clear traceability across the cyber security landscape.
• Knowledge of preventive, detective, corrective and compensating controls, with the ability to assess both design adequacy and operational effectiveness.
• Experience presenting cyber security controls and risk information to senior stakeholders and governance forums.
• Strong leadership, communication and stakeholder management skills, with the ability to influence technical teams, control owners and business leaders.
• Ability to operate effectively within a complex and highly regulated environment.

Desirable

• Familiarity with GRC platforms and integrated risk and controls management tools.
• Understanding of penetration testing, vulnerability management and red team activities, and how outputs support control improvement.
• Knowledge of security control automation and continuous control monitoring approaches.

Qualifications & Experience:

• Degree qualified, or equivalent, in Cyber Security, Information Security, Computer Science or a related discipline.
• Minimum of five years' experience within cyber security, including at least three years with direct responsibility for cyber security controls, controls frameworks or assurance programmes.
• Proven track record assessing the effectiveness of cyber security controls and managing remediation activities.
• Contribution to governance forums where control performance, remediation progress and risk treatment activities are reviewed.
• Experience supporting internal audits, assurance activities or compliance reviews.
• Preparation of control evidence and supporting documentation for audits, certifications or regulatory inspections.
• Experience working within, or closely alongside, Critical National Infrastructure sectors such as nuclear, defence, energy, transport, water or telecommunications.
• Professional certification such as CISSP, CISM, CRISC or equivalent.

Desirable

• Experience designing or significantly enhancing enterprise cyber security control frameworks aligned to ISO 27001 or equivalent standards.
• Previous people management, team leadership or functional leadership experience.
• Experience working with regulators, auditors or external assurance bodies.

Why Join us?

• Be part of one of the most important low-carbon energy projects in the UK.
• Work in a mission-driven environment that values innovation, integrity, and long-term sustainability.
• Competitive salary, comprehensive benefits, and opportunities for career development.
• Flexible and hybrid working options.

Key Competencies:

Humility

• Recognise the value brought fromdifferent culturesand experiences
• Be open to other's points of view and ideas, be willing to debate and to compromise

Positivity

• Positively challengepoor qualityand performance
• Identifysolutions at the lowest possible level
• Encourage tier 1s and others to bringnew ideasforward

Respect

• Value the rules and environment in which we operate
• Give and receive feedback with respect
• Embrace and engage with new people and ideas

Solidarity

• One team, working closely together and helping each other
• Empowered teams always looking forward.
• Shared responsibility for delivery the project outcomes

Clarity

• Communicate clearly and consistently
• Promote collaboration and team alignment
• Clearer and faster decision making
• Drive simplification at all levels

If this sounds like the next step in your career, we'd love to hear from you.