Cyber Controls Manager (Sizewell C)
The Sizewell C Jobs Service supports local people into exciting, long-term careers across our Project.#SZCJobs
Cyber Controls Manager
Sizewell C
Security Clearance: Active Security Clearance is required and must already be in place
Location: London, Leiston or Ipswich, with hybrid working and a minimum of 2 days per week on-site. Travel to other Sizewell C locations may be required.
Contract: Permanent, full-time
Salary: £82,200 - £84,000 depending on experience, plus benefits
Benefits include:
Annual Leave: 28 days per annum, increasing to 30 days after 5 years of service, plus bank holidays
Bonus: 5% annual bonus
Pension Contributions: Defined Contribution Pension Scheme with up to 7.5% employee contribution 15% employer contribution
Life Assurance: Up to 8 x salary
Closing Date: 30th September 2026
About the Role:
The Cyber Controls Manager plays a pivotal role in ensuring Sizewell C's cyber security controls are effective, auditable and aligned to organisational, regulatory and business requirements.
Reporting directly to the Chief Information Security Officer (CISO), you will own and manage the organisation's cyber security controls framework, maintaining clear traceability between cyber risks, regulatory obligations and the controls implemented to mitigate them. Acting as the bridge between risk identification and risk treatment, you will ensure controls are appropriately designed, documented, monitored and evidenced.
The role also provides leadership to the Cyber Controls Specialist and works closely with cyber, digital, assurance and programme delivery teams to strengthen the organisation's cyber resilience and governance arrangements.
Key Responsibilities:
Cyber Controls Framework
Own and maintain the organisation's cyber security controls library, ensuring it remains comprehensive, structured and audit ready.
Define and maintain the controls taxonomy, categorising controls by domain and control type.
Ensure controls are documented consistently, including ownership, implementation status, associated risks, supporting requirements and effectiveness evidence.
Maintain alignment between controls, regulatory obligations, contractual requirements and recognised cyber security frameworks.
Establish robust governance and change management processes to support the continual improvement of the control’s framework.
Cyber Risk & Controls Design
Work closely with the Cyber Risk Manager to ensure controls are identified, assessed and mapped against new and existing cyber risks.
Maintain end-to-end traceability between cyber risks, regulatory requirements and implemented controls.
Define control objectives and collaborate with technical teams to develop implementation guidance, testing criteria and evidence requirements.
Support the continuous enhancement of the control environment in response to emerging threats, incidents, audits and lessons learned.
Provide leadership and direction to the Cyber Controls Specialist, ensuring the effective delivery of cyber controls management activities.
Controls Monitoring & Assurance
Support compliance and regulatory activities by providing control evidence and demonstrating control effectiveness.
Collaborate with assurance teams to align control monitoring activities with assurance programmes and remediation plans.
Monitor control performance, identifying weaknesses, gaps or degraded controls and recommending corrective action.
Evaluate control effectiveness against current and emerging cyber threats.
Track the outcomes of control testing activities, including penetration testing, vulnerability assessments and security exercises, ensuring identified actions are progressed to completion.
Governance, Reporting & Stakeholder Engagement
Attend governance forums and provide updates on control effectiveness, control coverage, remediation activities and emerging risks.
Advise stakeholders on appropriate control selection and implementation in support of risk treatment activities.
Prepare reports and dashboards for the CISO and senior leadership, communicating technical information in a clear and accessible manner.
Maintain governance records, testing evidence and supporting documentation to an auditable standard.
Work with programme and project teams to ensure security controls are embedded throughout the system lifecycle and considered within governance processes from the outset.
Knowledge & Skills:
Strong understanding of cyber security control frameworks, including ISO 27001, and the principles of control design, implementation, assessment and governance.
Ability to develop and maintain risk-to-control and requirement-to-control mappings, providing clear traceability across the cyber security landscape.
Knowledge of preventive, detective, corrective and compensating controls, with the ability to assess both design adequacy and operational effectiveness.
Experience presenting cyber security controls and risk information to senior stakeholders and governance forums.
Strong leadership, communication and stakeholder management skills, with the ability to influence technical teams, control owners and business leaders.
Ability to operate effectively within a complex and highly regulated environment.
Desirable
Familiarity with GRC platforms and integrated risk and controls management tools.
Understanding of penetration testing, vulnerability management and red team activities, and how outputs support control improvement.
Knowledge of security control automation and continuous control monitoring approaches.
Qualifications & Experience:
Degree qualified, or equivalent, in Cyber Security, Information Security, Computer Science or a related discipline.
Minimum of five years' experience within cyber security, including at least three years with direct responsibility for cyber security controls, controls frameworks or assurance programmes.
Proven track record assessing the effectiveness of cyber security controls and managing remediation activities.
Contribution to governance forums where control performance, remediation progress and risk treatment activities are reviewed.
Experience supporting internal audits, assurance activities or compliance reviews.
Preparation of control evidence and supporting documentation for audits, certifications or regulatory inspections.
Experience working within, or closely alongside, Critical National Infrastructure sectors such as nuclear, defence, energy, transport, water or telecommunications.
Professional certification such as CISSP, CISM, CRISC or equivalent.
Desirable
Experience designing or significantly enhancing enterprise cyber security control frameworks aligned to ISO 27001 or equivalent standards.
Previous people management, team leadership or functional leadership experience.
Experience working with regulators, auditors or external assurance bodies.
Why Join us?
Be part of one of the most important low-carbon energy projects in the UK.
Work in a mission-driven environment that values innovation, integrity, and long-term sustainability.
Competitive salary, comprehensive benefits, and opportunities for career development.
Flexible and hybrid working options.
For this role you must have evidence of right to work in the UK. As a project, we do not discriminate on the grounds of age, gender, race, colour, religion, disability or sexual orientation, and we welcome applications from all sections of the community.
The Sizewell C Jobs Service supports local people into exciting, long-term careers across our Project.#SZCJobs
Cyber Controls Manager
Sizewell C
Security Clearance: Active Security Clearance is required and must already be in place
Location: London, Leiston or Ipswich, with hybrid working and a minimum of 2 days per week on-site. Travel to other Sizewell C locations may be required.
Contract: Permanent, full-time
Salary: £82,200 - £84,000 depending on experience, plus benefits
Benefits include:
Annual Leave: 28 days per annum, increasing to 30 days after 5 years of service, plus bank holidays
Bonus: 5% annual bonus
Pension Contributions: Defined Contribution Pension Scheme with up to 7.5% employee contribution 15% employer contribution
Life Assurance: Up to 8 x salary
Closing Date: 30th September 2026
About the Role:
The Cyber Controls Manager plays a pivotal role in ensuring Sizewell C's cyber security controls are effective, auditable and aligned to organisational, regulatory and business requirements.
Reporting directly to the Chief Information Security Officer (CISO), you will own and manage the organisation's cyber security controls framework, maintaining clear traceability between cyber risks, regulatory obligations and the controls implemented to mitigate them. Acting as the bridge between risk identification and risk treatment, you will ensure controls are appropriately designed, documented, monitored and evidenced.
The role also provides leadership to the Cyber Controls Specialist and works closely with cyber, digital, assurance and programme delivery teams to strengthen the organisation's cyber resilience and governance arrangements.
Key Responsibilities:
Cyber Controls Framework
Own and maintain the organisation's cyber security controls library, ensuring it remains comprehensive, structured and audit ready.
Define and maintain the controls taxonomy, categorising controls by domain and control type.
Ensure controls are documented consistently, including ownership, implementation status, associated risks, supporting requirements and effectiveness evidence.
Maintain alignment between controls, regulatory obligations, contractual requirements and recognised cyber security frameworks.
Establish robust governance and change management processes to support the continual improvement of the control’s framework.
Cyber Risk & Controls Design
Work closely with the Cyber Risk Manager to ensure controls are identified, assessed and mapped against new and existing cyber risks.
Maintain end-to-end traceability between cyber risks, regulatory requirements and implemented controls.
Define control objectives and collaborate with technical teams to develop implementation guidance, testing criteria and evidence requirements.
Support the continuous enhancement of the control environment in response to emerging threats, incidents, audits and lessons learned.
Provide leadership and direction to the Cyber Controls Specialist, ensuring the effective delivery of cyber controls management activities.
Controls Monitoring & Assurance
Support compliance and regulatory activities by providing control evidence and demonstrating control effectiveness.
Collaborate with assurance teams to align control monitoring activities with assurance programmes and remediation plans.
Monitor control performance, identifying weaknesses, gaps or degraded controls and recommending corrective action.
Evaluate control effectiveness against current and emerging cyber threats.
Track the outcomes of control testing activities, including penetration testing, vulnerability assessments and security exercises, ensuring identified actions are progressed to completion.
Governance, Reporting & Stakeholder Engagement
Attend governance forums and provide updates on control effectiveness, control coverage, remediation activities and emerging risks.
Advise stakeholders on appropriate control selection and implementation in support of risk treatment activities.
Prepare reports and dashboards for the CISO and senior leadership, communicating technical information in a clear and accessible manner.
Maintain governance records, testing evidence and supporting documentation to an auditable standard.
Work with programme and project teams to ensure security controls are embedded throughout the system lifecycle and considered within governance processes from the outset.
Knowledge & Skills:
Strong understanding of cyber security control frameworks, including ISO 27001, and the principles of control design, implementation, assessment and governance.
Ability to develop and maintain risk-to-control and requirement-to-control mappings, providing clear traceability across the cyber security landscape.
Knowledge of preventive, detective, corrective and compensating controls, with the ability to assess both design adequacy and operational effectiveness.
Experience presenting cyber security controls and risk information to senior stakeholders and governance forums.
Strong leadership, communication and stakeholder management skills, with the ability to influence technical teams, control owners and business leaders.
Ability to operate effectively within a complex and highly regulated environment.
Desirable
Familiarity with GRC platforms and integrated risk and controls management tools.
Understanding of penetration testing, vulnerability management and red team activities, and how outputs support control improvement.
Knowledge of security control automation and continuous control monitoring approaches.
Qualifications & Experience:
Degree qualified, or equivalent, in Cyber Security, Information Security, Computer Science or a related discipline.
Minimum of five years' experience within cyber security, including at least three years with direct responsibility for cyber security controls, controls frameworks or assurance programmes.
Proven track record assessing the effectiveness of cyber security controls and managing remediation activities.
Contribution to governance forums where control performance, remediation progress and risk treatment activities are reviewed.
Experience supporting internal audits, assurance activities or compliance reviews.
Preparation of control evidence and supporting documentation for audits, certifications or regulatory inspections.
Experience working within, or closely alongside, Critical National Infrastructure sectors such as nuclear, defence, energy, transport, water or telecommunications.
Professional certification such as CISSP, CISM, CRISC or equivalent.
Desirable
Experience designing or significantly enhancing enterprise cyber security control frameworks aligned to ISO 27001 or equivalent standards.
Previous people management, team leadership or functional leadership experience.
Experience working with regulators, auditors or external assurance bodies.
Why Join us?
Be part of one of the most important low-carbon energy projects in the UK.
Work in a mission-driven environment that values innovation, integrity, and long-term sustainability.
Competitive salary, comprehensive benefits, and opportunities for career development.
Flexible and hybrid working options.
For this role you must have evidence of right to work in the UK. As a project, we do not discriminate on the grounds of age, gender, race, colour, religion, disability or sexual orientation, and we welcome applications from all sections of the community.