Job Search

We are seeking an experienced Risk & Controls Manager (Cyber & Technology) to strengthen the management of technology, information security and cyber risk across a complex organisation. This role will provide independent challenge, practical guidance and oversight of the control environment, helping to ensure that key risks are identified, assessed, treated and reported effectively. You will work closely with technology, cyber security, operational risk, audit, compliance and business stakeholders to promote strong risk management practices and resilient ways of working.

Key responsibilities will include maintaining and enhancing cyber and technology risk frameworks, policies, standards and control methodologies; facilitating risk and control assessments; reviewing the design and operating effectiveness of controls; and monitoring remediation activity arising from incidents, audits, assessments and regulatory requirements. You will produce clear and insightful management information, risk reporting and committee papers, highlighting emerging threats, control weaknesses, trends and areas requiring management attention. The role will also support risk acceptance processes, third-party and supplier risk reviews, technology change governance, business continuity and resilience activities, and the development of risk awareness across relevant teams.

We are looking for a confident and collaborative professional with proven experience in technology risk, cyber security controls, information security governance, IT audit or a closely related discipline. You will have a strong understanding of recognised risk and control frameworks, regulatory expectations and common cyber security principles, together with the ability to interpret technical information and communicate its business impact clearly. Relevant professional qualifications in risk, audit, information security or technology would be advantageous. Excellent analytical, organisational and stakeholder management skills are essential, as is the ability to influence at all levels, challenge constructively and manage competing priorities in a fast-paced environment.

We are seeking a Risk & Controls Analyst (Cyber & Technology) to support the effective management of technology, information security and cyber risks across a complex business environment. The role will help strengthen the control framework, improve risk visibility and provide constructive challenge to ensure that key risks are identified, assessed and managed within agreed appetite.

Responsibilities will include maintaining risk and control documentation, supporting risk and control assessments, and helping to identify gaps, weaknesses and opportunities for improvement. You will coordinate control testing and assurance activity, review evidence, track remediation plans and monitor actions through to completion. The role will also involve analysing incidents, audit findings and control failures to identify recurring themes and emerging risks, preparing clear management information, and producing concise reports for governance forums and senior stakeholders. You will work closely with technology, cyber security, privacy, compliance, audit and operational teams to embed proportionate controls and promote consistent risk management practices. Where required, you will contribute to the development and review of policies, standards, procedures and risk acceptance documentation.

To succeed, you should have experience in technology risk, information security, IT controls, cyber governance or a related discipline, ideally within a regulated or complex organisation. You will be comfortable interpreting control frameworks and recognised standards, such as ISO 27001, NIST, COBIT or similar, and applying them in a practical business context. Strong analytical and problem-solving skills are essential, along with the ability to assess evidence, identify control deficiencies and communicate recommendations clearly to both technical and non-technical audiences. You should be organised, proactive and confident managing multiple priorities, with excellent written and verbal communication skills. Relevant professional qualifications or certifications, such as CISA, CRISC, CISSP or ISO 27001, would be advantageous but are not essential.

We are seeking an experienced Principal Information Security Officer to provide strategic leadership and expert guidance across information security, cyber risk, and resilience. This role will shape and advance the security framework, ensuring that policies, standards, and controls support business objectives while protecting sensitive information, systems, and services. You will act as a trusted adviser to senior stakeholders, translating complex security matters into clear business risks and practical recommendations.

Key responsibilities include developing and maintaining the information security strategy, governance framework, and risk management approach; overseeing security policies, procedures, and control assurance; and providing direction on security architecture, identity and access management, vulnerability management, data protection, and cloud security. You will support the identification, assessment, and treatment of information and cyber risks, monitor compliance with relevant legal, regulatory, and industry requirements, and contribute to audit and assurance activities. The role will also provide senior oversight during security incidents, helping coordinate effective response, investigation, remediation, and lessons learned. You will promote security-by-design principles across projects, technology change, procurement, and third-party relationships, while strengthening organisational awareness through training and engagement.

The successful candidate will bring substantial experience in information security, cybersecurity governance, risk management, or a closely related field, ideally gained in a complex or highly regulated environment. You should have strong knowledge of recognised security frameworks and standards, such as ISO 27001, NIST, or CIS, alongside a sound understanding of data protection, business continuity, and incident management. Relevant professional qualifications, such as CISSP, CISM, CRISC, or equivalent experience, are desirable. Excellent communication, influencing, analytical, and problem-solving skills are essential, as is the ability to work collaboratively with technical and non-technical stakeholders. This is an opportunity to make a significant contribution to organisational resilience, secure transformation, and the continuous improvement of information security capabilities.

We are seeking an experienced Senior Security Architect to define and advance the security architecture across a complex, evolving technology environment. In this role, you will develop security strategies, principles, standards and reference architectures that support business objectives while protecting applications, data, infrastructure and digital services. You will work closely with technology, engineering, risk, compliance and operational teams to ensure security is embedded throughout the design, delivery and lifecycle of products and platforms.

Your responsibilities will include assessing current and future architectures, identifying security risks and recommending practical, proportionate controls. You will provide expert guidance on cloud security, identity and access management, network security, application security, data protection, threat modelling and secure development practices. You will review solution designs, contribute to security patterns and policies, support major transformation initiatives, and help establish consistent approaches to vulnerability management, resilience and incident preparedness. You will also communicate complex risks clearly to both technical and non-technical stakeholders and support governance, assurance and audit activities where required.

Applicants should have significant experience in security architecture, cyber security engineering or a closely related discipline, with a strong understanding of enterprise architecture and modern cloud technologies. Experience designing secure solutions across hybrid environments, applying recognised security frameworks and translating risk into actionable outcomes is essential. Relevant professional qualifications, such as CISSP, SABSA, CCSP, CISM or equivalent, would be advantageous. You should be confident influencing senior stakeholders, facilitating design reviews and working collaboratively across multiple teams. Strong analytical, communication and problem-solving skills are essential, together with a pragmatic, risk-based approach and a commitment to continuous improvement.

We are seeking an OT Security Engineer to help protect industrial control systems, operational technology environments and critical infrastructure from evolving cyber threats. In this role, you will work closely with engineering, operations, IT and risk teams to strengthen the security of plant-floor networks, industrial assets and connected systems while supporting safe, reliable and compliant operations. You will contribute to the development and continual improvement of OT security standards, architecture, processes and technical controls across a complex and highly regulated environment.

Your responsibilities will include assessing OT networks and systems for vulnerabilities, reviewing security configurations, supporting risk assessments and coordinating remediation activities. You will help maintain asset inventories, network diagrams, segmentation designs and security documentation, while monitoring relevant alerts, investigating incidents and supporting containment and recovery activities. You will also participate in threat modelling, security testing, change reviews and project assessments for new or upgraded control systems. The role will involve collaborating with external suppliers and internal stakeholders to ensure that security requirements are understood and embedded throughout the system lifecycle. Where appropriate, you will support audits and demonstrate alignment with recognised standards and frameworks such as IEC 62443, NIST, ISO 27001 or applicable regulatory requirements.

The successful candidate will have practical experience in OT, ICS, SCADA, DCS or industrial network security, together with a sound understanding of networking, firewalls, remote access, endpoint protection, vulnerability management and incident response. Experience working in operational environments where availability, safety and controlled change are essential is highly desirable. You should be confident translating technical risks for both specialist and non-specialist audiences, able to work independently and comfortable coordinating activity across multiple teams. Relevant qualifications or certifications in cybersecurity, industrial control systems or networking are beneficial. A methodical approach, strong communication skills and a commitment to continuous improvement are essential.

We are seeking an experienced Security Compliance Manager – PCI DSS Specialist to lead and strengthen payment card security compliance across the organisation. The successful candidate will be responsible for managing the PCI DSS compliance programme, maintaining oversight of applicable requirements, and ensuring that security controls remain effective, current, and aligned with business operations. This role will work closely with information security, technology, risk, audit, legal, and operational teams to promote a consistent and practical approach to compliance.

Key responsibilities include coordinating PCI DSS assessments, supporting the preparation of Reports on Compliance and Attestations of Compliance, and managing evidence collection, control testing, remediation plans, and audit activities. You will maintain accurate documentation, policies, procedures, system inventories, data-flow diagrams, and compliance records. The role will also involve identifying control gaps, assessing risks, tracking corrective actions, and providing clear progress updates to senior stakeholders. You will advise project and engineering teams on secure payment environments, segmentation, vulnerability management, access control, encryption, logging, monitoring, incident response, and third-party compliance. Where required, you will support investigations and ensure that security incidents involving payment card data are escalated and managed appropriately.

Applicants should have substantial experience in PCI DSS compliance, security governance, risk management, or a related discipline, with a strong understanding of current PCI DSS requirements and their practical application in complex environments. Experience working with Qualified Security Assessors, internal and external auditors, payment service providers, and technology teams is highly desirable. Relevant certifications such as PCI QSA, CISSP, CISM, CRISC, or equivalent professional qualifications would be advantageous. You should be confident interpreting technical and regulatory requirements, communicating with both technical and non-technical audiences, and influencing stakeholders at all levels. Strong analytical, organisational, documentation, and project management skills are essential, together with a proactive approach to problem-solving and continuous improvement.

We are seeking an experienced Head of Cyber Security to lead the cyber security strategy across a diverse portfolio of renewable energy and thermal generation assets. This senior leadership role will be responsible for protecting critical operational technology (OT), information technology (IT), industrial control systems, and supporting infrastructure throughout the asset lifecycle. You will define security priorities, establish effective governance, and ensure that cyber risk is identified, managed, and communicated across technical and business stakeholders.

Key responsibilities will include developing and implementing a risk-based cyber security programme aligned with recognised standards and regulatory requirements; overseeing security architecture, vulnerability management, threat detection, incident response, identity and access management, and security monitoring; and ensuring robust controls are embedded into new projects, acquisitions, engineering activities, and third-party engagements. You will lead the assessment and improvement of OT security across generation sites, work closely with operations and engineering teams, and coordinate responses to significant cyber incidents. The role will also involve managing specialist suppliers, budgets, policies, assurance activities, and performance reporting for senior leadership.

The successful candidate will bring substantial experience leading cyber security within energy, utilities, industrial, manufacturing, or another critical infrastructure environment, with strong knowledge of both IT and OT security principles. Experience with industrial control systems, security frameworks such as NIST CSF or IEC 62443, regulatory compliance, operational resilience, and cyber risk management is essential. You should be an influential communicator with the ability to translate complex technical risks into clear business decisions and build collaborative relationships at all levels. A relevant degree or professional qualification in cyber security, information technology, engineering, or a related discipline is desirable, alongside recognised certifications such as CISSP, CISM, GIAC, or equivalent. The role may require travel to operational sites and participation in an out-of-hours incident management rota.

We are seeking an experienced Cyber Compliance & Assurance Manager to lead the development, implementation and continuous improvement of cyber security compliance and assurance activities. This role will help ensure that information security controls, policies and processes remain effective, proportionate and aligned with relevant legislation, regulatory expectations, industry standards and organisational risk appetite.

You will manage the cyber assurance framework, coordinating control assessments, internal reviews, independent audits and evidence-gathering activities across technology and business functions. Responsibilities will include maintaining compliance registers and risk documentation, tracking remediation plans, challenging control owners where appropriate, and producing clear reports for senior stakeholders and governance forums. You will support the interpretation and application of standards such as ISO 27001, NIST, CIS Controls and applicable data protection requirements, while helping embed a culture of security, accountability and continual improvement.

The successful candidate will have proven experience in cyber security governance, risk, compliance or assurance, with a strong understanding of security controls, audit principles and risk management methodologies. Relevant professional qualifications or certifications, such as CISA, CISSP, CISM, CRISC, ISO 27001 Lead Auditor or equivalent, are desirable. You will be confident engaging with technical and non-technical audiences, managing multiple priorities and communicating complex issues clearly to senior decision-makers. Strong analytical, organisational and stakeholder management skills are essential, along with the ability to work collaboratively, exercise sound judgement and operate effectively in a changing environment. Experience of third-party risk, regulatory assessments, security testing oversight and developing management information would be advantageous.

We are seeking a Customer Security Manager to lead the development and delivery of effective security practices across customer-facing operations. In this role, you will act as a trusted security partner for customers, helping them understand security requirements, manage risk, and respond confidently to emerging threats. You will work closely with internal technology, compliance, legal, product, and service teams to ensure security is embedded throughout the customer lifecycle.

Your responsibilities will include managing customer security reviews, questionnaires, audits, and due diligence requests; preparing clear and accurate responses to security and privacy enquiries; and supporting the development of customer-facing security documentation. You will maintain strong relationships with key stakeholders, identify opportunities to improve security processes, and help coordinate responses to security incidents affecting customers. The role will also involve monitoring relevant regulatory and industry developments, contributing to risk assessments, supporting security awareness initiatives, and reporting on customer security activity, trends, and performance to senior stakeholders.

The successful candidate will have experience in customer security, information security, risk management, compliance, assurance, or a related field. You should be confident communicating complex technical and regulatory topics to both technical and non-technical audiences, with excellent written and verbal communication skills. Knowledge of recognised security frameworks and standards, such as ISO 27001, SOC 2, NIST, or equivalent, is desirable, as is experience with data protection requirements and third-party risk management. We are looking for someone organised, commercially aware, and comfortable managing multiple priorities while maintaining accuracy and discretion. A collaborative approach, strong analytical ability, sound judgement, and a genuine commitment to building customer trust are essential.

We are seeking an AI Security Tester to assess the security, reliability, and resilience of artificial intelligence systems across their full development lifecycle. You will design and execute adversarial tests against machine learning models, generative AI applications, data pipelines, APIs, and supporting infrastructure. Your work will help identify vulnerabilities such as prompt injection, data leakage, insecure model configurations, adversarial manipulation, poisoning, excessive permissions, unsafe outputs, and weaknesses in authentication or access controls.

In this role, you will create realistic threat scenarios, develop test cases, automate security assessments, and analyse results to determine business and technical impact. You will collaborate with software engineers, data scientists, security specialists, and product teams to validate mitigations and ensure issues are resolved effectively. Responsibilities will include reviewing system architectures and code, conducting penetration tests, evaluating third-party AI components, documenting findings, and producing clear reports for both technical and non-technical stakeholders. You may also contribute to security standards, testing methodologies, risk assessments, incident investigations, and continuous monitoring of AI-enabled services.

The successful candidate will have experience in application security, penetration testing, red teaming, or security research, together with a strong understanding of AI and machine learning concepts. Practical knowledge of Python and common security testing tools is expected, along with familiarity with web applications, APIs, cloud environments, identity and access management, and secure software development practices. Experience testing large language models, retrieval-augmented generation systems, model endpoints, or AI agents would be advantageous. You should be analytical, curious, and comfortable working independently while communicating complex findings clearly. Relevant professional certifications or demonstrable contributions to security research, vulnerability disclosure, or open-source testing tools are desirable.