Job Search

We are seeking an experienced Risk & Controls Manager (Cyber & Technology) to strengthen the management of technology and cyber risk across a complex organisation. This role will provide effective challenge, oversight and practical guidance to ensure that technology services, information assets and security processes are managed within an appropriate risk and control framework. You will work closely with senior stakeholders, technology teams, risk specialists and control owners to promote strong governance and a consistent approach to risk management.

Key responsibilities will include maintaining and enhancing cyber and technology risk frameworks, policies, standards and control libraries; identifying, assessing and monitoring risks; and supporting the development of appropriate mitigation and remediation plans. You will coordinate control assessments, assurance activity, risk reporting and issue management, ensuring that findings are clearly documented, tracked and resolved within agreed timescales. The role will also involve preparing insightful management information and board-level reporting, contributing to regulatory and audit requirements, and providing constructive challenge on the design and operation of controls. You will help embed risk awareness through workshops, guidance and engagement with colleagues across the business.

Applicants should have substantial experience in technology risk, cyber risk, IT controls, information security or a related governance and assurance discipline. A strong understanding of recognised risk and control frameworks, cyber security principles, technology operations, third-party risk and regulatory expectations is essential. You will be confident interpreting complex information, assessing control effectiveness and communicating clearly with both technical and non-technical audiences. The successful candidate will demonstrate sound judgement, attention to detail and the ability to influence stakeholders at all levels, while managing competing priorities and delivering to deadlines. Relevant professional qualifications or certifications in risk, audit, information security or technology, such as CISA, CRISC, CISM or CISSP, would be advantageous.

We are seeking a Risk & Controls Analyst (Cyber & Technology) to support the effective identification, assessment and management of technology and information security risks. Working with stakeholders across technology, cyber security, risk, audit and the wider business, you will help strengthen the control environment and promote consistent, risk-based practices across the organisation.

Your responsibilities will include maintaining risk and control registers, coordinating control assessments, reviewing evidence and monitoring remediation activity. You will support the design, implementation and testing of controls relating to areas such as access management, vulnerability management, change management, incident response, third-party risk, data protection and business continuity. You will analyse control performance, identify weaknesses and emerging risks, and prepare clear reports, dashboards and recommendations for relevant governance forums. The role will also involve supporting internal and external audits, tracking actions to completion, contributing to policy and procedure updates, and helping to embed cyber and technology risk awareness throughout the business.

We are looking for experience in technology risk, information security, IT controls, cyber assurance, audit or a closely related discipline. You will have a good understanding of common control frameworks and standards, such as ISO 27001, NIST, COBIT or ITIL, together with practical knowledge of risk assessment and control testing methodologies. Strong analytical and problem-solving skills are essential, as is the ability to interpret technical information and communicate it clearly to both technical and non-technical audiences. You should be organised, detail-focused and confident managing multiple priorities and stakeholders. Relevant professional qualifications, such as CISA, CRISC, CISSP, ISO 27001 or equivalent experience, would be advantageous.

We are seeking a Security and Assurance Engineer to help strengthen the security, resilience and compliance of technology services across a complex and evolving environment. You will work with engineering, architecture, operations, risk and delivery teams to embed secure practices throughout the design, development and operation of systems. This role is suited to someone who can combine practical technical knowledge with a structured approach to assurance, risk management and continuous improvement.

Your responsibilities will include assessing systems and services against security policies, standards and regulatory requirements; identifying vulnerabilities, control gaps and emerging risks; and supporting the development of proportionate remediation plans. You will contribute to security reviews, threat and risk assessments, technical assurance activities, audit preparation and evidence gathering. You will also help maintain security documentation, standards, procedures and risk registers, while monitoring actions through to completion. The role may involve reviewing designs, cloud and infrastructure configurations, access controls, logging, vulnerability management, incident response arrangements and third-party security provisions.

You will ideally have experience in information security, cyber assurance, systems engineering, governance, risk or a closely related discipline. Knowledge of security frameworks and standards such as ISO 27001, NIST, CIS Controls or applicable data protection requirements would be valuable. Experience working with cloud platforms, secure development principles, identity and access management, vulnerability assessment or security tooling is desirable. You should be able to communicate clearly with both technical and non-technical audiences, challenge constructively and translate complex risks into practical recommendations. Strong analytical, organisational and problem-solving skills are essential, along with the ability to manage competing priorities and work collaboratively across multiple teams. Relevant professional certifications or demonstrable equivalent experience would be advantageous.

We are seeking an OT Security Engineer to strengthen the security and resilience of operational technology environments across critical industrial and infrastructure operations. In this role, you will help protect industrial control systems, supervisory control and data acquisition (SCADA) platforms, distributed control systems, plant networks, and connected operational assets. You will work closely with engineering, operations, IT, and risk teams to identify threats, reduce vulnerabilities, and support secure, reliable production.

Your responsibilities will include conducting OT security assessments, analysing network architecture and traffic, maintaining asset inventories, and identifying vulnerabilities across industrial environments. You will develop and implement appropriate security controls, including network segmentation, secure remote access, access management, endpoint protection, monitoring, and configuration standards. You will support incident detection and response, investigate security events, contribute to root-cause analysis, and help coordinate recovery activities while minimising operational disruption. The role will also involve creating and maintaining security policies, procedures, risk assessments, technical documentation, and compliance evidence. You may contribute to security-by-design reviews for new systems, upgrades, and engineering projects, as well as supplier and third-party risk assessments.

Applicants should have practical experience in OT, ICS, SCADA, industrial networking, or a closely related security engineering environment. A strong understanding of industrial protocols such as Modbus, DNP3, OPC, or IEC 61850, together with knowledge of TCP/IP networking, firewalls, vulnerability management, and security monitoring, is highly desirable. Familiarity with recognised standards and frameworks such as IEC 62443, NIST Cybersecurity Framework, NIST SP 800-82, or ISO 27001 would be advantageous. Relevant professional certifications in cybersecurity, networking, or industrial control systems are welcome. You should be analytical, methodical, and confident communicating technical risks to both specialist and non-specialist audiences. The ability to work collaboratively, manage competing priorities, and occasionally support planned maintenance or incident response outside normal hours will be important.

We are seeking a Senior Security Architect to define and strengthen security architecture across a complex technology environment. In this senior role, you will develop practical, scalable security strategies that support business objectives while protecting applications, infrastructure, data and digital services. You will work closely with technology, engineering, risk, compliance and operational teams to embed security by design throughout the delivery lifecycle.

Key responsibilities will include creating and maintaining security architecture principles, standards, reference models and roadmaps; reviewing proposed solutions and identifying security risks, control gaps and remediation requirements; and providing expert guidance on cloud, network, identity, application, data and endpoint security. You will contribute to threat modelling, security design reviews, technology assessments and major transformation programmes. The role will also involve influencing architectural decisions, supporting risk acceptance processes, advising on incident response preparedness and helping ensure alignment with relevant regulatory, privacy and industry requirements.

Applicants should have substantial experience in security architecture, information security engineering or a related discipline, with a strong understanding of modern enterprise technologies and security frameworks. Experience designing secure cloud and hybrid environments, implementing zero-trust principles, and applying security controls across development and operational environments is highly desirable. Professional certifications such as CISSP, SABSA, CCSP, CISM or equivalent are advantageous. You will be an effective communicator who can explain complex technical issues to both specialist and non-specialist audiences, build trusted relationships with senior stakeholders and influence outcomes without relying solely on formal authority. Strong analytical, problem-solving and decision-making skills are essential, together with a pragmatic approach to balancing security, usability, cost and delivery priorities.

We are seeking an experienced Head of Cyber Security Renewables & Thermal to lead the cyber security strategy across a diverse portfolio of renewable energy and thermal generation assets. This senior leadership role will be responsible for protecting operational technology, information systems, and critical infrastructure across the full asset lifecycle, from project development and construction through to commissioning and operations. You will establish clear security standards, governance frameworks, and risk-based priorities aligned with regulatory obligations, industry best practice, and business objectives.

You will lead a specialist cyber security function and work closely with engineering, operations, technology, risk, compliance, procurement, and executive stakeholders. Key responsibilities include developing and implementing cyber security strategies for operational technology and industrial control systems; overseeing threat, vulnerability, and risk management; setting security requirements for new projects, suppliers, and acquisitions; and ensuring effective incident response, resilience, monitoring, and recovery capabilities. You will also provide expert advice on secure-by-design principles, network architecture, identity and access management, asset visibility, security testing, and the protection of remote and connected environments. The role will involve building strong security culture and awareness across both corporate and operational teams.

The successful candidate will bring significant experience leading cyber security in critical infrastructure, energy, utilities, manufacturing, or another highly regulated industrial environment. A strong understanding of OT and IT security, industrial control systems, relevant standards such as IEC 62443 and ISO 27001, and applicable cyber security legislation is essential. You will be an influential communicator with proven experience managing teams, budgets, third-party relationships, and complex transformation programmes. Strategic thinking, sound judgement, and the ability to translate technical risk into clear business decisions are key. Professional certifications such as CISSP, CISM, GIAC, or equivalent are desirable, alongside a degree or comparable experience in cyber security, information technology, engineering, or a related discipline.

We are seeking an experienced Head of Cyber Security to lead the protection of renewable energy and thermal generation assets across a complex, evolving operational technology environment. This senior role will define and execute the cyber security strategy for generation sites, corporate systems and critical infrastructure, ensuring that security is embedded across the full asset lifecycle—from project development and engineering through to commissioning, operation and decommissioning.

You will provide strategic leadership for cyber security governance, risk management, incident response and resilience across information technology and operational technology environments. Key responsibilities include developing security standards and policies; overseeing threat and vulnerability management; establishing effective monitoring, detection and response capabilities; and ensuring compliance with relevant regulatory, industry and infrastructure protection requirements. You will work closely with engineering, operations, technology, risk, legal and project teams to assess cyber risks, prioritise investment and deliver practical security improvements. The role will also involve managing security requirements for third parties, suppliers and major capital projects, as well as leading responses to significant cyber incidents and supporting business continuity and recovery planning.

The successful candidate will bring substantial experience in cyber security leadership within energy, utilities, industrial, manufacturing or another critical infrastructure environment. You will have a strong understanding of OT and IT security principles, industrial control systems, network architecture, cloud technologies, identity management and secure-by-design practices. Experience working with recognised frameworks and standards such as NIST, IEC 62443 or ISO 27001 is highly desirable. An ability to communicate complex risks clearly to senior stakeholders, influence at board and executive level, and build effective relationships across technical and non-technical teams is essential. You should be commercially aware, decisive and able to balance robust security controls with the operational demands of safe, reliable energy generation.

We are seeking a Cyber Compliance & Assurance Manager to lead the development, implementation and continuous improvement of cyber security compliance and assurance activities. This role will help ensure that information security controls, policies and processes remain effective, proportionate and aligned with regulatory obligations, industry standards and organisational risk appetite.

You will be responsible for maintaining the cyber compliance framework, coordinating internal and external assurance reviews, and monitoring adherence to applicable requirements such as ISO 27001, NIST, CIS Controls and relevant data protection legislation. Key duties will include planning and delivering control assessments, identifying gaps, documenting risks and remediation actions, and preparing clear reports for senior stakeholders and governance forums. You will also support audit activity, track findings through to resolution, and provide constructive challenge to technology and business teams. The role will involve working closely with risk, privacy, legal, internal audit, architecture and operational security colleagues to embed consistent and sustainable security practices.

The successful candidate will have significant experience in cyber security governance, risk, compliance or assurance, with a strong understanding of control frameworks, audit methodologies and risk management principles. You should be confident interpreting regulatory and contractual requirements, assessing control effectiveness and communicating complex issues to both technical and non-technical audiences. Experience managing assurance programmes, third-party risk reviews, security policies and remediation plans is highly desirable, as is a relevant professional qualification such as CISA, CISM, CISSP, CRISC or ISO 27001 Lead Auditor. We are looking for an organised, analytical and collaborative professional who can influence stakeholders, manage competing priorities and promote a culture of continuous improvement.

We are seeking an experienced SAP Security Architect and Team Lead to design, implement and govern secure SAP environments across a complex enterprise landscape. This role will provide architectural leadership for SAP security, identity and access management, ensuring that solutions support business needs while meeting internal controls, regulatory obligations and industry best practice. You will work closely with technology, risk, audit and business stakeholders to define security strategies, establish standards and drive continuous improvement across SAP platforms.

Key responsibilities will include developing SAP security architecture and roadmaps; designing role concepts, authorisations and segregation-of-duties controls; overseeing user lifecycle management, privileged access and emergency access processes; and supporting the secure integration of SAP systems with identity providers, cloud services and third-party applications. You will lead security assessments, identify risks and vulnerabilities, coordinate remediation activities, and contribute to SAP implementation, migration and transformation programmes. The role will also involve managing and mentoring a team of SAP security specialists, allocating work, reviewing deliverables and promoting consistent, high-quality practices. You will act as a subject-matter expert during audits, incidents and major change initiatives.

Applicants should have substantial experience in SAP security architecture and hands-on knowledge of SAP authorisations, roles and profiles, ideally across SAP S/4HANA, ECC and relevant cloud solutions. Experience with SAP Identity Management, SAP Cloud Identity Services, governance, risk and compliance tools, and integration with enterprise identity platforms would be advantageous. You should understand security frameworks, access governance, segregation of duties and controls testing, with the ability to translate complex technical issues into clear business recommendations. Strong leadership, stakeholder management, communication and problem-solving skills are essential, along with the ability to work independently and influence decisions at all levels. Relevant SAP security certifications or equivalent professional experience are desirable.

We are seeking a Principal Product Security Engineer to lead the integration of security throughout the product development lifecycle. In this influential role, you will define and advance product security strategy across software, cloud services, APIs, and connected technologies. You will partner with engineering, architecture, product management, privacy, and operations teams to identify risks early, establish pragmatic security requirements, and ensure that security is built into products by design.

Your responsibilities will include driving threat modelling, secure architecture reviews, vulnerability management, security testing, and risk assessments for complex products and platforms. You will develop and maintain security standards, patterns, and guidance; advise teams on secure coding and authentication, authorisation, cryptography, data protection, and cloud security; and help establish measurable security objectives and controls. You will also assess emerging technologies and threats, support incident response and root-cause analysis, and contribute to security reviews for new features, acquisitions, integrations, and significant architectural changes. Where appropriate, you will help automate security checks within CI/CD pipelines and improve the visibility and remediation of product security risks.

The successful candidate will bring significant experience in product or application security, with a strong understanding of secure software development and modern engineering practices. You should be comfortable influencing senior stakeholders and technical teams without relying on formal authority, translating complex security issues into clear business and engineering decisions. Experience with cloud platforms, APIs, containers, infrastructure as code, software supply-chain security, and common application security testing tools is highly desirable. Relevant professional certifications or equivalent practical experience are welcome. We value curiosity, sound judgement, strong communication, and a collaborative approach, along with the ability to balance security, usability, delivery timelines, and customer needs.