Cyber Security Programme Manager (NIS / OT – Water Utilities)

Project Global Limited; Snodland; Hybrid; GBP 111,000 - 166,000; Full time

Job summary

Project Global Limited is seeking a Cyber Security Programme Manager (NIS / OT – Water Utilities) for a hybrid role based in the UK. You will lead end-to-end NIS/CAF v4 initiatives, coordinating IT, OT engineering, operations and risk governance to protect essential water services.

The role covers capital deployments and base operational improvements, including regulatory compliance with the UK NIS Regulations, MFA deployment, and secure-by-design processes.

Qualifications

• Experience leading IT/OT convergence programmes in regulated utilities.
• Knowledge of UK NIS Regulations and CAF v4 is preferred.
• Evidence of managing multi-stakeholder delivery and governance.

Responsibilities

• Oversee end-to-end NIS/CAF v4 programme for water utilities.
• Coordinate IT, OT engineering, operations and governance.
• Balance capital deployments with base operational initiatives.
• Drive security maturity including MFA and secure-by-design processes.

Skills

Critical Infrastructure Leadership

IT/OT convergence

Regulatory compliance

Executive communication

Vendor management

Tools

Siemens

Ovarro

Job description

Cyber Security Programme Manager (NIS / OT – Water Utilities)

Job Reference Number: PG1

Our client, a leading global supplier for IT services, requires an experienced Cyber Security Programme Manager (NIS / OT – Water Utilities) to be based at their client’s office in Snodland, Kent UK.

This is a hybrid role – you can work remotely in the UK and attend the Snodland, Kent office 1-2 days per week.

This is a 6+ month temporary contract to start asap

Day rate: Competitive Market rate

The Role:

This role holds end-to-end accountability for the client’s Network and Information Systems (NIS) Programme, protecting ring-fenced AMP8 capital funding while simultaneously driving the broader maturation of their enterprise-wide cyber security posture. Operating as the central bridge between IT, OT Engineering, Operations, and Corporate Risk, this role oversees a complex, blended portfolio. You will manage both Enhanced technical capital deployments (e.g., site modernisations, PLC replacements, network segmentation) and ‘Base’ operational initiatives (e.g., business continuity overhauls, supply chain cyber resilience, and governance). Your ultimate mandate is to ensure all physical, logical, and procedural deliverables collectively meet the stringent targets of the DWI Regulatory Notice and the eCAF Sector-Specific Profile.

Key Responsibilities

• Blended Portfolio & Benefits Alignment: The ability to orchestrate a complex portfolio of both Enhanced capital projects and Base operational initiatives, ensuring every output directly contributes to achieving the required status for the enhanced CAF sector-specific profile of the NIS CAF v4.
• Cross-Functional Resource Management: Highly skilled at orchestrating dedicated project resources in a matrixed environment. You must be able to negotiate and resolve friction between Capital Delivery and Planned Maintenance teams, ensuring field deployment squads are effectively ring-fenced from BAU firefighting to hit hard regulatory deadlines.
• Dynamic Risk Mitigation: A proactive approach to identifying, quantifying, and mitigating interconnected regulatory, cyber, and operational risks. Capable of balancing aggressive deployment schedules against live site environments, ensuring network isolation and upgrades do not disrupt essential water supply functions.
• Transformational Change Management: Expertise in driving profound organisational and behavioural change across field teams, engineering departments, and the supply chain. You must be able to overcome cultural resistance to new cybersecurity protocols (e.g., MFA, jump-boxes, least-privilege access) and embed secure-by-design processes into daily operations.
• Financial & Totex Acumen: The skill to manage multi-million-pound budgets, specifically protecting ring-fenced AMP8 funding, while navigating the nuances of strict regulatory capital versus operational business costs, ensuring all projects remain financially viable and protected from clawback.
• Executive & Tactical Communication: The ability to articulate complex IT/OT challenges, regulatory risks, and strategic benefits to the Executive Sponsor (SRO), external regulators, and operational site staff in a clear, concise, and persuasive manner.

Key Requirements

Essential:

• Critical Infrastructure Leadership: A proven track record of successfully leading complex IT/OT convergence or transformation programmes within Critical National Infrastructure (CNI) or heavily regulated utility environments.
• Sector-Specific Regulatory Expertise: Deep practical knowledge of the UK NIS Regulations and a demonstrated track record of delivering compliance against the enhanced CAF sector-specific profile of the NIS CAF v4. Familiarity with ISA/IEC 62443 industrial automation security standards is highly desirable.
• OT Architecture & Field Delivery: Evidence of operating within structured Operational Technology environments, possessing a firm grasp of Purdue Model segmentation, SCADA systems, PLCs, and telemetry network modernisations.
• Governance & Evidence Engine Management: Experience building and managing robust compliance frameworks (e.g., Master Action Trackers, evidence repositories) that translate technical field deployments into robust audit evidence for external technical assurance partners and regulators (e.g., DWI, Ofwat).
• Industrial Vendor Management: Experience managing complex relationships with Tier-1 industrial engineering partners, OT framework vendors (e.g., Siemens, Ovarro), and external assurance auditors, navigating high-stakes SLAs and strict compliance deliverables.
• Enterprise Cyber Maturation: Experience elevating an organisation’s holistic cyber posture beyond just technical hardware, including leading business continuity overhauls, driving third-party supply chain resilience, and executing enterprise-wide cyber culture campaigns.

Desirable:

• End-to-End Programme Delivery: Manage the comprehensive NIS portfolio, spanning IT, OT, and Operations, from initiation to closure. Ensure all physical, logical, and procedural deliverables collectively achieve the required status for the enhanced CAF sector-specific profile of the NIS CAF v4 by the mandated regulatory deadlines.
• Hub-and-Spoke Execution: Direct the hybrid delivery structure, overseeing both central PMO governance and the ring-fenced field deployment squads responsible for executing site communications modernisations and complex AMP8 PLC replacements.
• Capital Protection & Financial Control: Manage the overall financial health of the ring-fenced AMP8 capital allocation. Make strategic decisions to optimise spending, rigorously separate Enhanced regulatory spend from Base operational costs, and demonstrate a clear return on investment to ensure regulatory compliance.
• Operational Risk & Dependency Management: Take ownership of the complex interdependencies between site deployments, network boundary hardening, and legacy IT systems. Proactively mitigate programme-level risks to ensure operational resilience and zero disruption to essential water services during commissioning windows.
• Lead the enterprise-wide procedural changes required to support technical deployments. Secure buy-in across all levels to overhaul Business Continuity Plans (BCP), establish manual operational overrides, and enforce critical supply chain cyber resilience.
• Regulatory Reporting & Assurance: Oversee the central evidence repository and Master Action Tracker (MAT). Ensure all workstream outputs pass rigorous internal gateways and external technical assurance audits, ultimately preparing the internal draft assurance and annual DWI progress submissions for Executive Sponsor sign-off.
• Actively manage the expectations of a wide range of stakeholders, from field technicians up to the Executive Technical Committee. Nurture strategic relationships with key external delivery partners, regulators, and technical assurance bodies.

Due to the volume of applications received, unfortunately we cannot respond to everyone

If you do not hear back from us within 7 days of sending your application, please assume that you have not been successful on this occasion.

Please do keep an eye on our website https://projectrecruit.com/jobs/ for future roles.