Cyber Controls Manager

Sizewell C Limited; Greater London; Hybrid; GBP 85,000 - 110,000; Full time

Benefits offered by this job

Annual Leave

Bonus

Pension Contributions

Life Assurance

Job summary

Sizewell C Limited is seeking a Cyber Controls Manager to lead and maintain the organisation's cyber security controls framework. The role requires active security clearance and will be based in London, Leiston or Ipswich with hybrid working and on-site presence.

You will report to the CISO, own the controls library, ensure evidence and governance, and work with risk, assurance and programme teams to improve cyber resilience. Strong leadership and experience with ISO 27001 are essential.

Qualifications

• Degree in Cyber Security, Information Security or related field.
• Minimum 5 years in cyber security with 3+ years in controls, frameworks or assurance.
• Experience presenting to senior stakeholders and governance forums.
• Experience supporting audits, assurance activities or regulatory inspections.

Responsibilities

• Own and maintain the cyber security controls library and taxonomy.
• Ensure controls are documented with ownership, status, risks and evidence.
• Maintain traceability between risks, obligations and controls.
• Collaborate with risk, cyber, assurance and delivery teams to strengthen governance.
• Provide leadership to the Cyber Controls Specialist and ensure effective delivery.

Skills

Cyber security controls

ISO 27001

Governance & risk

Stakeholder engagement

Leadership

Regulatory compliance

Threat awareness

Education

Degree in Cyber Security

Tools

GRC platforms

Job description

Sizewell C is entering an exciting phase of growth as we mature into an independent organisation and continue building one of the UK’s largest and most important energy projects. We are now recruiting the below position.

Position: Cyber Controls Manager

Security Clearance: Active Security Clearance is required and must already be in place

Location: London, Leiston or Ipswich, with hybrid working and a minimum of 2 days per week on-site. Travel to other Sizewell C locations may be required.

Contract: Permanent, full-time

Benefits include:

• Annual Leave: 28 days per annum, increasing to 30 days after 5 years of service, plus bank holidays
• Bonus: 5% annual bonus
• Pension Contributions: Defined Contribution Pension Scheme with up to 7.5% employee contribution 15% employer contribution
• Life Assurance: Up to 8 x salary

Closing Date: 1st October 2026

About the Role:

The Cyber Controls Manager plays a pivotal role in ensuring Sizewell C's cyber security controls are effective, auditable and aligned to organisational, regulatory and business requirements.

Reporting directly to the Chief Information Security Officer (CISO), you will own and manage the organisation's cyber security controls framework, maintaining clear traceability between cyber risks, regulatory obligations and the controls implemented to mitigate them. Acting as the bridge between risk identification and risk treatment, you will ensure controls are appropriately designed, documented, monitored and evidenced.

The role also provides leadership to the Cyber Controls Specialist and works closely with cyber, digital, assurance and programme delivery teams to strengthen the organisation's cyber resilience and governance arrangements.

Key Responsibilities:

Cyber Controls Framework

• Own and maintain the organisation's cyber security controls library, ensuring it remains comprehensive, structured and audit ready.
• Define and maintain the controls taxonomy, categorising controls by domain and control type.
• Ensure controls are documented consistently, including ownership, implementation status, associated risks, supporting requirements and effectiveness evidence.
• Maintain alignment between controls, regulatory obligations, contractual requirements and recognised cyber security frameworks.
• Establish robust governance and change management processes to support the continual improvement of the control’s framework.
• Work closely with the Cyber Risk Manager to ensure controls are identified, assessed and mapped against new and existing cyber risks.
• Maintain end-to-end traceability between cyber risks, regulatory requirements and implemented controls.
• Define control objectives and collaborate with technical teams to develop implementation guidance, testing criteria and evidence requirements.
• Support the continuous enhancement of the control environment in response to emerging threats, incidents, audits and lessons learned.
• Provide leadership and direction to the Cyber Controls Specialist, ensuring the effective delivery of cyber controls management activities.

Controls Monitoring & Assurance

• Support compliance and regulatory activities by providing control evidence and demonstrating control effectiveness.
• Collaborate with assurance teams to align control monitoring activities with assurance programmes and remediation plans.
• Monitor control performance, identifying weaknesses, gaps or degraded controls and recommending corrective action.
• Evaluate control effectiveness against current and emerging cyber threats.
• Track the outcomes of control testing activities, including penetration testing, vulnerability assessments and security exercises, ensuring identified actions are progressed to completion.

Governance, Reporting & Stakeholder Engagement

• Attend governance forums and provide updates on control effectiveness, control coverage, remediation activities and emerging risks.
• Advise stakeholders on appropriate control selection and implementation in support of risk treatment activities.
• Prepare reports and dashboards for the CISO and senior leadership, communicating technical information in a clear and accessible manner.
• Maintain governance records, testing evidence and supporting documentation to an auditable standard.
• Work with programme and project teams to ensure security controls are embedded throughout the system lifecycle and considered within governance processes from the outset.

Knowledge & Skills:

• Strong understanding of cyber security control frameworks, including ISO 27001, and the principles of control design, implementation, assessment and governance.
• Ability to develop and maintain risk-to-control and requirement-to-control mappings, providing clear traceability across the cyber security landscape.
• Knowledge of preventive, detective, corrective and compensating controls, with the ability to assess both design adequacy and operational effectiveness.
• Experience presenting cyber security controls and risk information to senior stakeholders and governance forums.
• Strong leadership, communication and stakeholder management skills, with the ability to influence technical teams, control owners and business leaders.
• Ability to operate effectively within a complex and highly regulated environment.
• Familiarity with GRC platforms and integrated risk and controls management tools.
• Understanding of penetration testing, vulnerability management and red team activities, and how outputs support control improvement.
• Knowledge of security control automation and continuous control monitoring approaches.

Qualifications & Experience:

• Degree qualified, or equivalent, in Cyber Security, Information Security, Computer Science or a related discipline.
• Minimum of five years' experience within cyber security, including at least three years with direct responsibility for cyber security controls, controls frameworks or assurance programmes.
• Proven track record assessing the effectiveness of cyber security controls and managing remediation activities.
• Contribution to governance forums where control performance, remediation progress and risk treatment activities are reviewed.
• Experience supporting internal audits, assurance activities or compliance reviews.
• Preparation of control evidence and supporting documentation for audits, certifications or regulatory inspections.
• Experience working within, or closely alongside, Critical National Infrastructure sectors such as nuclear, defence, energy, transport, water or telecommunications.
• Professional certification such as CISSP, CISM, CRISC or equivalent.
• Experience designing or significantly enhancing enterprise cyber security control frameworks aligned to ISO 27001 or equivalent standards.
• Previous people management, team leadership or functional leadership experience.
• Experience working with regulators, auditors or external assurance bodies.

Why Join us?

• Be part of one of the most important low-carbon energy projects in the UK.
• Work in a mission-driven environment that values innovation, integrity, and long-term sustainability.
• Competitive salary, comprehensive benefits, and opportunities for career development.
• Flexible and hybrid working options.

Humility

• Recognise the value brought fromdifferent culturesand experiences
• Be open to other’s points of view and ideas, be willing to debate and to compromise

Positivity

• Positively challengepoor qualityand performance
• Identifysolutions at the lowest possible level
• Encourage tier 1s and others to bringnew ideasforward

Respect

• Value the rules and environment in which we operate
• Give and receive feedback with respect
• Embrace and engage with new people and ideas
• One team, working closely together and helping each other
• Empowered teams always looking forward.
• Shared responsibility for delivery the project outcomes

Clarity

• Communicate clearly and consistently
• Promote collaboration and team alignment
• Drive simplification at all levels