Cyber Risk Manager

Sizewell C Limited; Greater London; Hybrid; GBP 90,000 - 120,000; Full time

Benefits offered by this job

Annual leave

Bonus 10%

Pension contributions

Life assurance

Job summary

Sizewell C Limited is seeking a Cyber Risk Manager to lead the organisation's cyber risk management framework. You will translate threats into actionable insights, working with cyber security, digital, assurance and business teams to strengthen resilience and align with regulatory and business objectives.

Reporting to the CISO, you will own the risk register, taxonomy and scoring, ensuring escalation and governance, with a focus on protecting critical infrastructure in a highly regulated

Qualifications

• Degree qualified in Cyber Security, Information Security, Computer Science, Risk Management or related discipline.
• Minimum of five years in cyber security or information security, including at least three years with significant responsibility for cyber risk management.
• Proven track record of conducting or overseeing cyber risk assessments using ISO 27005, NIST RMF, FAIR or OCTAVE.
• Experience developing, maintaining and governing cyber risk registers within complex organisations.
• Relevant professional certifications such as CISSP, CISM, CRISC or equivalent.

Responsibilities

• Own and maintain the organisation's cyber risk register, ensuring risks are clearly documented and audit ready.
• Develop and maintain the cyber risk taxonomy, including risk categories, threat sources and impact domains aligned to critical business functions.
• Define and maintain risk scoring methodologies, appetite thresholds and escalation criteria.
• Ensure cyber risks are assessed, prioritised and managed consistently across the organisation.
• Provide guidance and support for complex cyber risk assessments as required.
• Lead the Cyber Risk Assessment Lead and oversee risk treatment plans with clear ownership and timelines.

Skills

Cyber risk frameworks

ISO 27005

NIST RMF

Risk management

Stakeholder management

Communication skills

Regulatory awareness

Education

Degree in Cyber Security / Information Security / CS / Risk Management

Job description

Sizewell C is entering an exciting phase of growth as we mature into an independent organisation and continue building one of the UK’s largest and most important energy projects. We are now recruiting the below position:

Security Clearance: Active Security Clearance is required and must already be in place

Location: London, Leiston or Ipswich, with hybrid working and a minimum of 2 days per week on-site. Travel to other Sizewell C locations may be required.

Contract: Permanent, full-time

Benefits include:

• Annual Leave: 28 days per annum, increasing to 30 days after 5 years of service, plus bank holidays
• Bonus: 10% annual bonus
• Pension Contributions: Defined Contribution Pension Scheme with up to 7.5% employee contribution 15% employer contribution
• Life Assurance: Up to 8 x salary

Closing Date: 1st October 2026

About the Role:

The Cyber Risk Manager plays a critical role in ensuring Sizewell C's cyber risks are identified, understood, prioritised and effectively managed.

Reporting directly to the Chief Information Security Officer (CISO), you will lead the organisation's cyber risk management framework, maintain oversight of the cyber risk landscape and ensure risks are managed in line with regulatory requirements and business objectives.

Operating at the intersection of technology, security and business risk, you will translate complex cyber threats into clear and actionable insights, enabling informed decision-making at all levels of the organisation. Working closely with cyber security, digital, assurance and business teams, you will help strengthen organisational resilience and ensure cyber risk remains a key consideration across strategic and operational activities.

Key Responsibilities:

• Own and maintain the organisation's cyber risk register, ensuring risks are clearly documented, appropriately owned and kept audit ready.
• Develop and maintain the cyber risk taxonomy, including risk categories, threat sources and impact domains aligned to critical business functions.
• Define and maintain risk scoring methodologies, appetite thresholds and escalation criteria in collaboration with senior leadership.
• Ensure cyber risks are assessed, prioritised and managed consistently across the organisation.
• Establish and maintain processes for the identification, assessment and recording of cyber risks.
• Ensure risk assessments are undertaken at appropriate trigger points, including new system deployments, major projects and significant business change.
• Oversee the application of recognised risk assessment methodologies and good practice.
• Provide guidance and support for complex cyber risk assessments where required.
• Provide line management and leadership to the Cyber Risk Assessment Lead
• Oversee the development and delivery of cyber risk treatment plans, ensuring clear ownership, realistic timescales and measurable outcomes.
• Work closely with cyber security and technology teams to ensure controls are implemented, effective and aligned to identified risks.
• Maintain traceability between identified risks, mitigating controls and remediation activities.
• Ensure risk acceptance decisions, exceptions and associated approvals are appropriately governed and documented.
• Prepare and present cyber risk reports, dashboards and insights for the CISO, senior leadership and governance forums.
• Monitor risk trends, emerging threats and mitigation progress, highlighting areas requiring management action.
• Escalate significant risks that exceed approved tolerance levels and provide recommendations for resolution.
• Ensure cyber risks are appropriately reflected within the wider enterprise risk management framework.
• Support regulatory submissions, audits and reviews by maintaining robust risk management records and evidence.

Stakeholder Engagement

• Provide expert advice and guidance on cyber risk management across the organisation.
• Collaborate with Security Operations, Digital and wider business teams to understand emerging threats and assess their potential impact.
• Support threat modelling, business impact assessments and wider cyber resilience activities.
• Promote a proactive and risk-informed culture across the organisation.

Knowledge & Skills:

• Thorough understanding of cyber risk frameworks and assessment methodologies, including ISO 27005 and NIST Risk Management Framework.
• Ability to develop and maintain cyber risk registers, taxonomies, risk scoring methodologies and risk appetite frameworks.
• Strong understanding of how cyber risk integrates with enterprise risk management and wider organisational governance processes.
• Ability to translate complex technical risks into clear and meaningful business language for non-technical audiences.
• Strong analytical, stakeholder management and communication skills.
• Experience presenting cyber risk information to senior leaders and governance forums.
• Ability to influence decision-making and drive effective risk-based outcomes across multiple stakeholder groups.
• Understanding of the UK nuclear cyber security regulatory landscape, including ONR requirements, Security Assessment Principles (SyAPs), NISR and NIS Regulations.
• Knowledge of threat intelligence processes and how cyber threat information supports ongoing risk assessment and decision-making.
• Familiarity with assurance, audit and regulatory compliance activities within highly regulated environments.

Qualifications & Experience:

• Degree qualified in Cyber Security, Information Security, Computer Science, Risk Management or a related discipline, or equivalent professional experience.
• Minimum of five years' experience within cyber security or information security, including at least three years with significant responsibility for cyber risk management.
• Proven track record of conducting or overseeing cyber risk assessments using recognised methodologies such as ISO 27005, NIST RMF, FAIR or OCTAVE.
• Experience developing, maintaining and governing cyber risk registers within complex organisations.
• Establishing or facilitating risk governance forums involving senior stakeholders and risk-based decision-making.
• Management of cyber risk treatment activities across multiple teams and competing priorities.
• Production of cyber risk reporting for executive and board-level audiences.
• Experience working within, or closely alongside, Critical National Infrastructure sectors such as nuclear, defence, energy, transport, water or telecommunications.
• Relevant professional certification such as CISSP, CISM, CRISC or equivalent.
• Background within the nuclear sector or other highly regulated industries.
• Familiarity with environments subject to external cyber security audits, regulatory inspections or formal assurance activities.
• Previous people management, mentoring or technical leadership experience within a cyber security or risk management function.

Why Join us?

• Be part of one of the most important low-carbon energy projects in the UK.
• Work in a mission-driven environment that values innovation, integrity, and long-term sustainability.
• Competitive salary, comprehensive benefits, and opportunities for career development.
• Flexible and hybrid working options.

Humility

• Recognise the value brought fromdifferent culturesand experiences
• Be open to other’s points of view and ideas, be willing to debate and to compromise

Positivity

• Positively challengepoor qualityand performance
• Identifysolutions at the lowest possible level
• Encourage tier 1s and others to bringnew ideasforward

Respect

• Value the rules and environment in which we operate
• Give and receive feedback with respect
• Embrace and engage with new people and ideas
• One team, working closely together and helping each other
• Empowered teams always looking forward.
• Shared responsibility for delivery the project outcomes

Clarity

• Communicate clearly and consistently
• Promote collaboration and team alignment
• Drive simplification at all levels