Cyber Risk Assessment Lead

Sizewell C Company; Greater London; Hybrid; GBP 74,000 - 90,000; Full time

Benefits offered by this job

Annual leave 28 days + bank holidays

5% annual bonus

Pension scheme up to 7.5% employee / 7

Job summary

Sizewell C Company is seeking a Cyber Risk Assessment Lead to shape and embed cyber risk capabilities across the organisation. You will own the assessment methodology and lead a team to deliver risk insights to governance forums.

Role requires active SC clearance, strong knowledge of ISO 27005, RMF, and threat modelling, and the ability to translate findings into actionable risk management actions for a major UK infrastructure project.

Qualifications

• Design and manage cyber risk assessment frameworks within a regulated environment.
• Produce risk reports and MI for senior stakeholders and governance bodies.
• Oversee risk assessments using recognised methodologies (ISO 27005, NIST RMF, FAIR, OCTAVE).
• Translate assessment outcomes into actionable risk management plans and mitigation actions.

Responsibilities

• Own and evolve the cyber risk assessment methodology, standards, tooling and quality framework.
• Lead day-to-day activities of the Cyber Risk Specialist and Cyber Risk Analyst.
• Manage the pipeline of Security Risk Assessments (SRAs) and ensure prioritisation.
• Coordinate third-party support for cyber risk assessments where required.
• Review and quality assure assessment outputs for consistency and compliance.
• Lead complex, high-impact cyber risk assessments and provide technical support to the team.
• Develop and support the Cyber Risk Specialist and Analyst for consistent practices.

Skills

Cyber risk assessment

ISO 27005

NIST RMF

Threat modelling

Stakeholder engagement

Communication skills

Regulatory alignment

Risk reporting

Education

Degree in Cyber Security

Information Security degree

Risk management qualification

Job description

Sizewell C is entering an exciting phase of growth as we mature into an independent organisation and continue building one of the UK's largest and most important energy projects. We are now recruiting the below position:

Position: Cyber Risk Assessment Lead

Security Clearance: Active Security Clearance is required and must already be in place

Location: London, Leiston or Ipswich, with hybrid working and a minimum of 2 days per week on-site. Travel to other Sizewell C locations may be required.

Contract: Permanent, full-time

Salary: £82,186 depending on experience, plus benefits

Benefits include:

• Annual Leave: 28 days per annum, increasing to 30 days after 5 years of service, plus bank holidays
• Bonus:5% annual bonus
• Pension Contributions: Defined Contribution Pension Scheme with up to 7.5% employee contribution 15% employer contribution
• Life Assurance: Up to 8 x salary

Closing Date: 1st October 2026

About the Role:

The Cyber Risk Assessment Lead plays a key role in shaping and embedding Sizewell C's cyber risk assessment capability across the organisation.

Reporting into the Cyber Risk Manager, you will own and evolve the cyber risk assessment methodology, ensuring risks are identified, accessed and communicated consistently across the business. You will be responsible for maintaining assessment standards, overseeing the delivery pipeline and ensuring cyber risk assessments remain aligned with industry best practice and regulatory expectations.

Leading the day-to-day activities of the Cyber Risk Specialist and Cyber Risk Analyst, you will provide technical guidance, quality assurance and oversight of cyber risk assessments, helping ensure risk-informed decision making across one of the UK's most significant infrastructure projects.

Key Responsibilities:

Risk Assessment Framework & Methodology

• Own and maintain the organisation's cyber risk assessment methodology, standards, tooling and quality framework.
• Drive continuous improvement of cyber risk assessment practices, incorporating lessons learned, emerging threats and industry best practice.
• Promote consistent adoption of cyber risk assessment processes across the organisation.
• Establish and maintain assessment criteria that ensure risks are evaluated and reported consistently.
• Ensure identified risks, control gaps and requirement shortfalls are appropriately documented and escalated through established risk management processes.

Assessment Programme Management

• Manage the pipeline of Security Risk Assessments (SRAs), ensuring assessments are prioritised, planned and delivered effectively.
• Provide leadership and direction to the Cyber Risk Specialist and Cyber Risk Analyst.
• Coordinate third-party support for cyber risk assessments where required.
• Review and quality assure assessment outputs to ensure consistency, accuracy and compliance with organisational standards.
• Lead complex, sensitive or high-impact cyber risk assessments and provide technical support to wider team members.
• Lead, develop and support the Cyber Risk Specialist and Cyber Risk Analyst, ensuring a consistent and effective approach to cyber risk assessment across the organisation.

Risk Management & Integration

• Support the Cyber Risk Manager in maintaining a current and accurate cyber risk position across the organisation.
• Ensure assessment findings are translated into actionable risk management outcomes and appropriately reflected within the cyber risk register.
• Contribute to the tracking and reporting of identified cyber risks and mitigation activities.
• Support integration between cyber risk management and wider enterprise risk management processes.
• Assist with business impact assessments, threat modelling exercises and risk analysis activities.

Stakeholder Engagement & Reporting

• Collaborate with Security Operations teams to ensure threat intelligence is incorporated into cyber risk assessments.
• Work closely with cyber security, digital and business teams to identify emerging risks and assess potential impacts.
• Produce clear and effective risk reports, dashboards and management information for leadership and governance forums.
• Present cyber risk assessment findings to both technical and non-technical stakeholders.
• Provide expert advice on cyber risk assessment approaches and methodologies across the organisation.

Knowledge & Skills:

• Strong understanding of cyber security risk assessment principles, frameworks and methodologies.
• Knowledge of recognised approaches such as ISO 27005, NIST Risk Management Framework (RMF), FAIR, OCTAVE or equivalent methodologies.
• Ability to design, implement and maintain effective cyber risk assessment processes within a complex and regulated environment.
• Strong understanding of threat identification, vulnerability analysis, likelihood assessment, impact assessment and residual risk evaluation.
• Ability to translate complex technical findings into clear, business-focused risk insights.
• Understanding of how cyber risk aligns with wider enterprise risk management frameworks.
• Excellent stakeholder engagement, analytical and communication skills.
• Ability to present findings confidently to governance forums, leadership teams and non-technical audiences.

Desirable

• Understanding of the UK nuclear regulatory landscape and the role of the Office for Nuclear Regulation (ONR).
• Knowledge of threat intelligence processes and how they support cyber risk assessment and decision-making.
• Familiarity with cyber governance, assurance and compliance practices within highly regulated environments.

Qualifications & Experience:

• Degree qualified, or equivalent, in Cyber Security, Information Security, Computer Science, Risk Management or a related discipline.
• Experience within cyber security, information security, risk management or security assurance, with a particular focus on cyber risk assessment.
• Demonstrable success designing, implementing or managing cyber risk assessment frameworks and methodologies.
• Proven ability to identify, assess and communicate cyber security risks in a structured and consistent manner.
• Experience conducting or overseeing cyber risk assessments using recognised methodologies such as ISO 27005, NIST RMF, FAIR or OCTAVE.
• Production of risk reports and management information for senior stakeholders, governance bodies or executive audiences.
• Experience presenting cyber risk findings and recommendations to both technical and non-technical stakeholders.
• Ability to convert assessment outcomes into actionable risk management plans and mitigation activities.
• Relevant professional certification such as CISSP, CISM, CRISC or equivalent.
• Eligibility for, or current holder of, Security Check (SC) clearance.

Desirable

• Experience within the nuclear sector or another highly regulated Critical National Infrastructure environment, such as defence, energy, transport or water.
• Supporting governance committees, assurance reviews or regulatory activities in a technical or advisory capacity.

Why Join us?

• Be part of one of the most important low-carbon energy projects in the UK.
• Work in a mission-driven environment that values innovation, integrity, and long-term sustainability.
• Competitive salary, comprehensive benefits, and opportunities for career development.
• Flexible and hybrid working options.

Key Competencies:

Humility

• Recognise the value brought fromdifferent culturesand experiences
• Be open to other's points of view and ideas, be willing to debate and to compromise

Positivity

• Positively challengepoor qualityand performance
• Identifysolutions at the lowest possible level
• Encourage tier 1s and others to bringnew ideasforward

Respect

• Value the rules and environment in which we operate
• Give and receive feedback with respect
• Embrace and engage with new people and ideas

Solidarity

• One team, working closely together and helping each other
• Empowered teams always looking forward.
• Shared responsibility for delivery the project outcomes

Clarity

• Communicate clearly and consistently
• Promote collaboration and team alignment
• Clearer and faster decision making
• Drive simplification at all levels