Cyber Security Manager

Airbus; Prestwick; On-site; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Pension plan

33 days annual leave

Annual bonus

Life assurance

Virtual GP service

Wellbeing programme

Professional development

Free on-site parking

Job summary

Prestwick Aerosystems Limited in Prestwick, Ayrshire, is seeking a Cyber Security Manager to own the end-to-end GRC estate and oversee the delivery of digital security and compliance across the organisation. You will report to the Digital Security Officer and help establish our ISMS while maintaining Airbus compliance.

The role covers governance, risk management, policy development, and cross-functional collaboration with OT, IT, and supply chain, with focus on ISO 27001:2022, NIST CSF 2.0, and

Qualifications

• Extensive experience leading Information Security Management, GRC, or cyber operations in aerospace/defence/manufacturing.
• Proven track record delivering an enterprise ISMS.

Responsibilities

• Own the complete GRC estate and ARM portal, track risks and ROM plans, collect audit evidence.
• Build and sustain ISMS policy suite aligned with ISO 27001:2022 and Airbus directives.
• Maintain Airbus Cybersecurity compliance levels and manage internal audits and remediation plans.
• Lead cybersecurity maturity assessments using NIST CSF 2.0 and threat modelling.
• Align OT with IT security and ensure regulatory compliance (EASA Part-IS).

Skills

GRC leadership

Security governance

Threat modelling

Audits and compliance

Education

Security governance certification (CISM/CRISC/CISA/CISSP)

Tools

GRC platforms (FENCE, MetricStream)

Microsoft Defender XDR

Job description

Job Description

Cyber Security Manager

Location: Prestwick, Ayrshire

Hours: 37 hours per week (half-day Friday)

Type: Full-time

Salary: Level 5

Travel Required: Occasional

Work Location: Site-based (100%)

Security Checks: BPSS, Disclosure Scotland, pre-employment medical (including drug and alcohol testing)

Join One of Ayrshire’s Largest Engineering Employers

Prestwick Aerosystems continues Ayrshire’s long-standing aircraft manufacturing tradition.

From our Prestwick site, we manufacture aircraft wing structures used on Airbus commercial aircraft worldwide.

Prestwick Aerosystems is seeking a Cyber Security Manager to own the complete GRC estate and lead the operational delivery of digital security and compliance across the organisation. Reporting directly to the Digital Security Officer (DSO), this role bridges strategic risk governance and steady-state business operations, taking core accountability for establishing and maintaining our ISMS, maintaining full Airbus compliance, and evaluating cybersecurity maturity.

Primary Responsibilities

How you will contribute to the team

• Full GRC Estate & Platform Ownership: Serve as the primary business owner for our GRC Suite and Active Risk Manager (ARM) portal, maintaining continuous control tracking, Risk and Opportunities Management (ROM) plans, and automated audit evidence.
• ISMS Build & Policy Governance: Build, localize, and sustain the Information Security Management System (ISMS) policy suite from scratch, aligning controls with ISO 27001:2022, the Airbus Digital Handbook, and mandatory Airbus Group Directives.
• Airbus Compliance & Audit Management: Maintain full operational compliance for Airbus Cybersecurity Level for subsidiaries, design internal audit schedules, run evaluations against the Airbus Subsidiary Questionnaire, and manage the remediation Action Plans.
• Cybersecurity Maturity & Threat Profiling: Lead ongoing baseline cybersecurity maturity assessments using NIST CSF 2.0 and execute industrial threat modelling using industry standard methodologies.

Secondary Responsibilities

• Operational Technology (OT) & Safety Alignment: Partner with factory operations to integrate the digital ISMS with physical Safety Management Systems (SMS) to maintain EASA Part-IS regulatory alignment.
• Security Operations & Incident Governance: Govern Microsoft Defender XDR security policies (Endpoint, Servers, Office 365) and act as the operational contact for our Managed Security Service Provider, driving post-incident Return of Experience (RETEX) root-cause reviews.
• Supply Chain & Third-Party Security: Conduct Supply Chain Information Security Assessments (SCISA), ensure mandatory Airbus clauses are integrated into supplier contracts, and verify vendor penetration tests.
• Security Culture & HR Liaison: Oversee employee security learning journeys, run phishing simulation campaigns, and partner with HR to enforce specialized recruitment screening for high-access positions.
• Team Leadership & Financial Control: Manage internal security staff and external contractors, execute performance management cycles, oversee GRC/security tool budgets, and enforce vendor performance SLAs.

Requirements For The Role

You will have:

• Extensive experience leading Information Security Management, GRC, or cyber operations in aerospace, defence, manufacturing, or heavy industrial sectors.
• Proven track record of designing, building, and delivering an enterprise ISMS.
• Deep expertise in ISO 27001:2022, NIST CSF 2.0, EASA Part-IS, and formal risk methodologies (EBIOS RM, ISO 27005, or NIST 800-30).
• Experience managing aerospace supply chain requirements and mandatory Airbus cybersecurity frameworks.
• Hands-on proficiency with GRC platforms (FENCE, MetricStream, etc) and the Microsoft Defender XDR stack.
• Professional certification in security governance, risk, or auditing (e.g., CISM, CRISC, CISA, CISSP, or ISO 27001 Lead Auditor/Implementer).
• Solid technical understanding of factory OT environments, network segmentation, and industrial automation security.

What We Will Offer You

• 37-hour working week (half-day Friday)
• Defined contribution pension (4% employee / 8% employer)
• 33 days annual leave (rising with service)
• Annual bonus linked to company performance
• Life assurance (4× basic salary)
• Virtual GP service, Employee
• Assistance Programme and wellbeing support
• Professional development and training opportunities
• Free on-site parking

What Happens Next

Right to Work in the UK

All applicants must have the legal right to work in the UK at the time of application. Prestwick Aerosystems is unable to offer visa sponsorship for this role. Any offer of employment will be subject to satisfactory Right to Work checks, carried out in accordance with UK Government requirements.

You will also be required to complete employment references, Disclosure Scotland and a pre-employment medical.

Prestwick Aerosystems is an equal opportunity employer. We welcome applications from all backgrounds and are committed to building a diverse and inclusive workplace.

This job requires an awareness of any potential compliance risks and a commitment to act with integrity, as the foundation for the Company’s success, reputation and sustainable growth.

Company

Prestwick Aerosystems Limited

Employment Type

Permanent

Experience Level

Professional

Job Family

Your application data will be processed by Prestwick Aerosystems and other companies under the control of Airbus for all necessary hiring, vetting, and security checks. This processing is required to assess your suitability for employment. For full details on how and why Airbus uses your data, please see our Privacy Notice .

Prestwick Aerosystems is committed to achieving workforce diversity and creating an inclusive working environment. We welcome all applications irrespective of social and cultural background, age, gender, disability, sexual orientation or religious belief.

As a part of Airbus, Prestwick Aerosystems is committed to equal opportunities for all. As such, we will never ask for any type of monetary exchange in the frame of a recruitment process. Any impersonation of Prestwick Aerosystems or Airbus to do so should be reported to [e-mail] .

At Prestwick Aerosystems, we support you to work, connect and collaborate more easily and flexibly. Wherever possible, we foster flexible working arrangements to stimulate innovative thinking.