Regulatory Cyber Assurance Principal

Ofgem; Greater London; Hybrid; GBP 57,000 - 70,000; Full time

Benefits offered by this job

Hybrid working

Civil Service Pension

30 days annual leave

Training & development

Job summary

Ofgem is recruiting two Regulatory Cyber Assurance Principals to strengthen cyber resilience across Great Britain's energy sector. You will lead assurance activities, assess compliance with the NIS Regulations and provide expert regulatory guidance to Operators of Essential Services.

The role blends cyber security, regulation and critical infrastructure oversight. You will engage with government partners and industry stakeholders, delivering evidence-based decisions and robust inspection reports

Qualifications

• Professional cyber security qualifications relevant to regulatory environments (e.g., CISSP, CISA, CISM, ISO 27001 Lead Auditor).
• Experience with cyber risk assessments in OT/IT for Critical National Infrastructure environments.
• Ability to advise on regulation and policy to promote good security practice across the sector.
• Proven ability to inspect, audit or test information security controls and produce clear reports.

Responsibilities

• Lead and maintain relationships with Operators of Essential Services (OES).
• Provide expert guidance on compliance with the NIS Regulations for the DGE sector.
• Lead regulatory assurance activities and align with regulatory expectations.
• Contribute to NIS inspections, reviews of evidence, on-site assessments and inspection reports.
• Assess and determine compliance status and document outcomes accurately.
• Escalate concerns and work with Enforcement on regulatory actions when needed.
• Develop cyber assurance policies, methods and regulatory approaches for continuous improvement.
• Collaborate with government, other authorities and industry to support resilience objectives.

Skills

Cyber risk assessments

OT/IT risk

Regulatory policy advice

Inspection & auditing

Written communication

Education

CISSP

CISA

CISM

ISO 27001 Lead Auditor

GICSP

ISA/IEC 62443 Cybersecurity Expert

Job description

Protect Great Britain's Critical Energy Infrastructure

At Ofgem, we work on behalf of energy consumers to ensure every household and business across Great Britain can rely on a safe, affordable and environmentally sustainable energy supply.

As Great Britain's energy system continues to evolve, cyber resilience plays a critical role in maintaining secure and reliable services. Through our responsibilities under the Network and Information Systems (NIS) Regulations, Ofgem acts as the Competent Authority for the Downstream Gas and Electricity (DGE) sector, helping ensure operational systems and networks remain resilient against cyber and related security threats.

We're looking for two experienced Regulatory Cyber Assurance Principals to join our Cyber Regulation team on a permanent basis. This is an opportunity to play a leading role in protecting critical national infrastructure, working directly with Operators of Essential Services (OES), government partners and industry stakeholders to strengthen cyber resilience across the energy sector.

As Ofgem's Cyber Assurance expert, you will lead and maintain relationships across a designated portfolio of Operators of Essential Services (OES), delivering a regulatory model that is engaging, collaborative and focused on improving cyber resilience.

You will provide leadership on cyber assurance activities across the Downstream Gas and Electricity sector, assessing compliance with the NIS Regulations, making expert compliance determinations and advising on appropriate regulatory responses where concerns or breaches are identified.

Working at the intersection of cyber security, regulation and critical national infrastructure, you will conduct assurance activities including inspections, review audit, exercising and technical testing outcomes, while influencing improvements that help safeguard services relied upon by millions of consumers across Great Britain.

Key Responsibilities

• Lead and maintain relationships across a designated portfolio of Operators of Essential Services (OES).
• Provide expert advice and guidance to the DGE sector on compliance with the NIS Regulations.
• Lead and support regulatory assurance and engagement activities, ensuring alignment with regulatory expectations.
• Contribute to and lead NIS inspections, including evidence reviews, on-site assessments and the production of high-quality inspection reports.
• Review and assess compliance documentation, including assurance reports, audit findings, exercising and testing outcomes, remediation plans and incident reports.
• Assess and make expert determinations on compliance with the NIS Regulations.
• Document inspection outcomes, assurance findings and regulatory decisions accurately and consistently.
• Escalate compliance concerns where appropriate and collaborate with Enforcement teams to support the application of regulatory tools and drive improvements.
• Provide expert advice regarding enforcement action where NIS Regulations have been breached.
• Lead the development and continuous improvement of cyber assurance policies, products, methodologies and regulatory approaches.
• Work collaboratively with government departments, other Competent Authorities, industry stakeholders and external assurance providers to support resilience objectives.
• Provide inclusive leadership through knowledge sharing, coaching and support across the Cyber Regulation team, contributing to Ofgem's values and culture.

Person specification

• Relevant professional qualification in cyber security, such as: CISSP, CISA, CISM, ISO 27001 Lead Auditor, GICSP, ISA/IEC 62443 Cybersecurity Expert, or a related degree. Equivalent experience in a cyber regulatory environment will also be considered. (LEAD)
• Expert in understanding cyber risk assessments and methodologies in relation to OT and IT of Critical National Infrastructure environments, and the application of appropriate and proportionate controls across people, process, and technology to mitigate risk.
• Practitioner in advising on the implementation of cyber regulation and policy, promoting good security practice within the sector.
• Proven experience of inspecting, auditing, or testing with an information security role.
• Strong technical author skills.
• Good understanding of the NIS Regulations and the NCSC Cyber Assessment Framework (CAF), with practical experience applying these eg in either policy, process, assurance, inspection, and/or enforcement activities.

Behaviours

We'll assess you against these behaviours during the selection process:

• Making Effective Decisions
• Communicating and Influencing
• Delivering at Pace

Alongside your salary of £63,443, OFGEM contributes £18,379 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).

Ofgem can offer you a comprehensive and competitive benefits package which includes; 30 days annual leave after 2 years; Excellent training and development opportunities; The opportunity to join the generous Civil Service pension which also includes a valuable range of benefits; hybrid working (currently 1 day a week in the office but this is kept under review), flexible working hours and family friendly policies. Plus lots of other benefits including clean and bright offices based centrally, engaged networks and teams and an opportunity to contribute to our ambitious and important targets of establishing a Net Zero energy system by 2050. This exciting blend of professional challenge and personal reward identifies career opportunities at Ofgem as something to get excited about.