Cyber Risk Manager

Sizewell C is entering an exciting phase of growth as we mature into an independent organisation and continue building one of the UK’s largest and most important energy projects. We are now recruiting the below position:

Position: Cyber Risk Manager

Security Clearance: Active Security Clearance is required and must already be in place Location: London, Leiston or Ipswich, with hybrid working and a minimum of 2 days per week on-site. Travel to other Sizewell C locations may be required. Contract: Permanent, full-time Salary: £86,000 - £89,000 depending on experience, plus benefits

Benefits include:

• Annual Leave: 28 days per annum, increasing to 30 days after 5 years of service, plus bank holidays
• Bonus: 10% annual bonus
• Pension Contributions: Defined Contribution Pension Scheme with up to 7.5% employee contribution 15% employer contribution
• Life Assurance: Up to 8 x salary

Closing Date: 1st October 2026

About the Role:

The Cyber Risk Manager plays a critical role in ensuring Sizewell C's cyber risks are identified, understood, prioritised and effectively managed.

Reporting directly to the Chief Information Security Officer (CISO), you will lead the organisation's cyber risk management framework, maintain oversight of the cyber risk landscape and ensure risks are managed in line with regulatory requirements and business objectives.

Operating at the intersection of technology, security and business risk, you will translate complex cyber threats into clear and actionable insights, enabling informed decision-making at all levels of the organisation. Working closely with cyber security, digital, assurance and business teams, you will help strengthen organisational resilience and ensure cyber risk remains a key consideration across strategic and operational activities.

Key Responsibilities:

Risk Register Management

• Own and maintain the organisation's cyber risk register, ensuring risks are clearly documented, appropriately owned and kept audit ready.
• Develop and maintain the cyber risk taxonomy, including risk categories, threat sources and impact domains aligned to critical business functions.
• Define and maintain risk scoring methodologies, appetite thresholds and escalation criteria in collaboration with senior leadership.
• Ensure cyber risks are assessed, prioritised and managed consistently across the organisation.

Risk Assessment Oversight

• Establish and maintain processes for the identification, assessment and recording of cyber risks.
• Ensure risk assessments are undertaken at appropriate trigger points, including new system deployments, major projects and significant business change.
• Oversee the application of recognised risk assessment methodologies and good practice.
• Provide guidance and support for complex cyber risk assessments where required.
• Provide line management and leadership to the Cyber Risk Assessment Lead

Risk Treatment & Mitigation

• Oversee the development and delivery of cyber risk treatment plans, ensuring clear ownership, realistic timescales and measurable outcomes.
• Work closely with cyber security and technology teams to ensure controls are implemented, effective and aligned to identified risks.
• Maintain traceability between identified risks, mitigating controls and remediation activities.
• Ensure risk acceptance decisions, exceptions and associated approvals are appropriately governed and documented.

Risk Reporting & Governance

• Prepare and present cyber risk reports, dashboards and insights for the CISO, senior leadership and governance forums.
• Monitor risk trends, emerging threats and mitigation progress, highlighting areas requiring management action.
• Escalate significant risks that exceed approved tolerance levels and provide recommendations for resolution.
• Ensure cyber risks are appropriately reflected within the wider enterprise risk management framework.
• Support regulatory submissions, audits and reviews by maintaining robust risk management records and evidence.

Stakeholder Engagement

• Provide expert advice and guidance on cyber risk management across the organisation.
• Collaborate with Security Operations, Digital and wider business teams to understand emerging threats and assess their potential impact.
• Support threat modelling, business impact assessments and wider cyber resilience activities.
• Promote a proactive and risk-informed culture across the organisation.

Knowledge & Skills:

• Thorough understanding of cyber risk frameworks and assessment methodologies, including ISO 27005 and NIST Risk Management Framework.
• Ability to develop and maintain cyber risk registers, taxonomies, risk scoring methodologies and risk appetite frameworks.
• Strong understanding of how cyber risk integrates with enterprise risk management and wider organisational governance processes.
• Ability to translate complex technical risks into clear and meaningful business language for non-technical audiences.
• Strong analytical, stakeholder management and communication skills.