Information Security & Data Governance Lead (UK)

SES Energy Ltd.; Aberdeen City; On-site; GBP 65,000 - 90,000; Full time

Job summary

SES Energy Ltd. is seeking a senior Information Security, Governance, Risk and Compliance professional to lead security policy development, data governance, and regulatory oversight. You will drive risk assessments across IT, OT, and cloud, while coordinating audits and controls effectiveness across multiple jurisdictions.

The role emphasizes secure-by-design principles, adherence to GDPR/UK DP laws, and collaboration with leadership on policy evolution and risk posture.

Qualifications

• Significant experience in information security, cybersecurity GRC, or IT governance.
• Proven experience implementing data governance frameworks.
• Strong understanding of international data protection and cybersecurity regulations.

Responsibilities

• Develop, implement, and maintain information and cyber security policies, standards, and procedures.
• Align with ISO 27001, NIST CSF, and CIS Controls frameworks.
• Conduct risk assessments across IT, cloud, and OT environments.
• Support incident response planning and continuous improvement of security controls.
• Embed secure-by-design principles into infrastructure and operations.
• Establish and maintain an enterprise data governance framework.
• Define data classification, handling, retention, and protection standards.
• Ensure GDPR, UK Data Protection Act, and applicable US privacy law compliance.
• Promote data ownership, stewardship, and accountability across business units.
• Lead internal and external audit activities and remediation tracking.
• Monitor regulatory changes and update policies accordingly.
• Oversee governance, risk, and compliance (GRC) activities and vendor risk.

Skills

InfoSec

GRC

IT Governance

Regulatory Compliance

Risk Assessment

Stakeholder Engagement

Security Standards

Job description

Principal Accountabilities

Information Security

• Develop, implement, and maintain information and cyber security policies, standards, and procedures
• Ensure alignment with recognized frameworks (ISO 27001, NIST CSF, CIS Controls)
• Conduct risk assessments across IT, cloud, and Operational Technology (OT) environments
• Support incident response planning and continuous improvement of security controls
• Embed secure-by-design principles into infrastructure and operational systems

Data Governance

• Establish and maintain an enterprise data governance framework
• Define and enforce data classification, handling, retention, and protection standards
• Ensure compliance with international data protection regulations including GDPR, UK Data Protection Act, and applicable US privacy laws
• Promote data ownership, stewardship, and accountability across business units
• Support data quality, integrity, and lifecycle management

Compliance & Regulatory Oversight

• Ensure compliance with applicable cybersecurity, data governance, and energy sector regulations
• Lead and support internal and external audit activities, including evidence collection and remediation tracking
• Maintain enterprise risk registers and compliance reporting
• Continuously monitor global cyber and data regulatory changes
• Assess impact of regulatory developments and update internal policies, standards, and procedures accordingly
• Ensure compliance is maintained across all regions of operation

Cybersecurity Awareness & Training

• Design and deliver enterprise cybersecurity awareness programmes
• Conduct phishing simulations and risk-based awareness campaigns
• Tailor training for corporate and operational (OT) environments
• Measure effectiveness and drive continuous improvement in user behaviour

Governance & Advisory

• Act as subject matter expert and advisor on security, governance, and compliance matters
• Administer and support third-party/vendor risk management programme
• Provide reporting and insights to leadership on security posture, regulatory changes, and risk exposure
• Contribute to the continuous improvement of governance, risk, and compliance (GRC) capability
• Member of change management board and contributor to change management process

Qualifications and Experience

Required

• Significant experience in information security, cybersecurity GRC, or IT governance roles
• Proven experience implementing data governance frameworks
• Strong understanding of international data protection and cybersecurity regulations

JOB DESCRIPTION

• Experience working within regulated environments
• Familiarity with ISO 27001, NIST, or equivalent frameworks
• Experience supporting audit and compliance processes

Desired

• Experience in the energy, utilities, or critical infrastructure sector
• Exposure to Operational Technology (OT) environments
• Professional certifications (e.g., CISSP, CISM, CRISC, CISA, CDMP)
• Experience with GRC tools (e.g., ServiceNow GRC, RSA Archer, MetricStream)

HSE Responsibilities

• Stop work by challenging and stopping unsafe acts and behaviours or unsafe conditions.
• Comply with Standard Operating Procedures defined in Responsibilities above, and company STOP WORK system.
• Ensure that cybersecurity considerations support safe and reliable operational environments, particularly within OT systems.

Competencies

• Risk & Compliance Expertise: Strong understanding of regulatory and governance frameworks
• Analytical Thinking: Ability to assess and mitigate complex risks
• Stakeholder Engagement: Ability to influence across technical and business teams
• Communication: Clear communication of technical and regulatory requirements
• Autonomy: Operates independently with accountability for outcomes
• Continuous Improvement: Proactively adapts to changing regulatory and threat landscapes

Any Other Information

• This is a senior individual contributor role with no direct reports
• The role operates across multiple jurisdictions with varying regulatory requirements