Cyber Policy Lead

The Financial Conduct Authority; Greater London; On-site; GBP 54,000 - 75,000; Full time

Benefits offered by this job

25 days annual leave

Pension 8–12%

Private healthcare

Income protection

Volunteer days

Job summary

Financial Conduct Authority (FCA) is seeking a Cyber Policy Lead to shape and govern the Cyber & Information Resilience policy framework. The role focuses on updating standards, guiding policy across the organisation, and aligning with risk appetite while acting as the main policy contact for BAU and project work.

You will lead horizon-scanning, support reporting on policy compliance, and collaborate with the CISO and HR to interpret policy requirements.

Qualifications

• Experience designing, drafting and maintaining cyber & information security policies.
• Knowledge of ISO 27001, NIST CSF, CIS Controls.
• Understanding of technical security controls including network, cloud, IAM and vulnerability management.
• Experience engaging with senior stakeholders up to Director level.

Responsibilities

• Manage Cyber & Information Policy and Standards updates per refresh cycles.
• Modernise policy & standards suite e.g. standards on a page.
• Act as the primary point of contact for policy-related queries, covering BAU and project activities.
• Support reporting on Policy Owner compliance and effectiveness of policies.
• Conduct horizon-scanning to identify emerging risks, trends, and regulatory changes.
• Develop requirements for a new self-service policy model for low-risk projects.
• Manage and modernise the Policy Waiver process.
• Provide policy guidance and interpretation to investigation teams and HR.

Skills

Policy design

Policy maintenance

Cybersecurity standards

ISO 27001

NIST CSF

Cloud security

IAM

Vulnerability management

Stakeholder management

Regulatory risk

Job description

Job title: Cyber Policy Lead

Salary: National (Edinburgh and Leeds) ranging from £53,800 to £70,000 and London from £59,200 to £75,000 (salary offered will be based on skills and experience)

This role is graded as: Senior Associate - Regulatory

About the FCA and team

We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you’ll play a key part in protecting consumers, driving economic growth and shaping the future of UK finance services.

The Cyber and Operational Resilience directorate enables secure and resilient regulation across the FCA and PSR, supporting the protection of UK consumers and financial markets. This Senior Associate sits within the Policy & Risk team, part of the wider Governance and Human Risk function. The role focuses on the management and maintenance of the Cyber & Information Resilience Policy Framework, including associated standards, procedures and guidance.

You will help to support and articulate the organisations Cyber Risk Appetite through the policy framework. You will also be a key point of contact from all areas of the FCA for queries against published requirements. You will support the Risk lead in setting and measuring controls performance and support the GHR Manager and CISO in reporting against cyber issues / non-compliance across the organisation.

Role responsibilities

• Manage Cyber & Information Policy and Cyber & Information Security Standards updates in line with agreed refresh periods
• Look to modernise our policy & standards suite e.g. standards on a page
• Act as the primary point of contact for policy-related queries, covering both BAU and project-related activities
• Support reporting on Policy Owner compliance e.g. effectiveness of our policies
• Conduct policy gap analysis and provide recommendations for improvement
• Complete and interpret regular horizon-scanning activities to identify emerging risks, trends, and regulatory changes
• Help develop and build requirements for a new self-service policy model for low-risk projects taking into account the FCA’s risk appetite
• Manage and modernise the Policy Waiver process
• Provide policy guidance and interpretation to specialist investigation teams and HR on policy requirements and specific cases

Skills required

• Minimum: Experience in designing, drafting and maintaining cyber & information security policies, standards and procedures across their full lifecycle
• Extensive working knowledge of industry standards such as ISO 27001, NIST Cybersecurity Framework (CIS), CIS Controls
• Essential: Understanding of technical security controls, including network security, cloud security, identity and access management and vulnerability management
• Working knowledge of Information Management practices and Data Privacy legislation
• Demonstrated experience in dealing with stakeholders at all levels (including Director level)
• Solid experience in delivering organisational change
• Risk identification, articulation and management

Benefits

• 25 days annual leave plus bank holidays
• Non-contributory pension (8–12% depending on age) and life assurance at eight times your salary
• Private healthcare with Bupa, income protection and 24/7 Employee Assistance
• 35 hours of paid volunteering annually
• Colleagues spend a minimum of 50% of their working time in the office each month (60% for Directors and Executive Directors) across our London, Leeds and Edinburgh offices.
• A flexible benefits scheme designed around your lifestyle
• A flexible benefits scheme designed around your lifestyle
• For a full list of our benefits and our recruitment process as a whole visit our benefits page.

Our values and culture

Our colleagues are the key to our success as a regulator. We are committed to fostering a diverse and inclusive culture: one that’s free from discrimination and bias, celebrates difference and supports colleagues to deliver at their best.

We believe that our differences and similarities enable us to be a better organisation – one that makes better decisions, drives innovation and delivers better regulation.

If you require any adjustments due to a disability or condition, your recruiter is here to help - reach out for tailored support.

We welcome diverse working styles and aim to find flexible solutions that suit both the role and individual needs, including options like part‑time and job sharing where applicable.

Disability confident: our hiring approach. We’re proud to be a Disability Confident Employer and therefore, people or individuals with disabilities and long-term conditions who best meet the minimum criteria for a role will go through to the next stage of the recruitment process. In cases of high application volumes we may progress applicants whose experience most closely matches the role’s key requirements.

Useful information and timelines

Timeline: Job advert close: 11th November 2026 at 11:59pm

CV Review/Shortlist: 13th November 2026

Interview: w/c 23rd November 2026

Your Recruiter will discuss the process in detail with you during screening for the role, therefore, please make them aware if you are going to be unavailable for any date during this time.

At the FCA, we’re creating a fair and more resilient financial system. We’re establishing more transparent relationships between financial services and their customers, building trust in financial markets and protecting vulnerable consumers.