Cyber Controls Manager

Sizewell C is entering an exciting phase of growth as we mature into an independent organisation and continue building one of the UK’s largest and most important energy projects. We are now recruiting the below position:

Position: Cyber Controls Manager Security Clearance: Active Security Clearance is required and must already be in place Location: London, Leiston or Ipswich, with hybrid working and a minimum of 2 days per week on-site. Travel to other Sizewell C locations may be required. Contract: Permanent, full-time Salary: £82,200 - £84,000 depending on experience, plus benefits

Benefits include:

• Annual Leave: 28 days per annum, increasing to 30 days after 5 years of service, plus bank holidays
• Bonus: 5% annual bonus
• Pension Contributions: Defined Contribution Pension Scheme with up to 7.5% employee contribution 15% employer contribution
• Life Assurance: Up to 8 x salary

Closing Date: 1st October 2026

About the Role:

The Cyber Controls Manager plays a pivotal role in ensuring Sizewell C's cyber security controls are effective, auditable and aligned to organisational, regulatory and business requirements.

Reporting directly to the Chief Information Security Officer (CISO), you will own and manage the organisation's cyber security controls framework, maintaining clear traceability between cyber risks, regulatory obligations and the controls implemented to mitigate them. Acting as the bridge between risk identification and risk treatment, you will ensure controls are appropriately designed, documented, monitored and evidenced.

The role also provides leadership to the Cyber Controls Specialist and works closely with cyber, digital, assurance and programme delivery teams to strengthen the organisation's cyber resilience and governance arrangements.

Key Responsibilities:

Cyber Controls Framework

• Own and maintain the organisation's cyber security controls library, ensuring it remains comprehensive, structured and audit ready.
• Define and maintain the controls taxonomy, categorising controls by domain and control type.
• Ensure controls are documented consistently, including ownership, implementation status, associated risks, supporting requirements and effectiveness evidence.
• Maintain alignment between controls, regulatory obligations, contractual requirements and recognised cyber security frameworks.
• Establish robust governance and change management processes to support the continual improvement of the control’s framework.

Cyber Risk & Controls Design

• Work closely with the Cyber Risk Manager to ensure controls are identified, assessed and mapped against new and existing cyber risks.
• Maintain end-to-end traceability between cyber risks, regulatory requirements and implemented controls.
• Define control objectives and collaborate with technical teams to develop implementation guidance, testing criteria and evidence requirements.
• Support the continuous enhancement of the control environment in response to emerging threats, incidents, audits and lessons learned.
• Provide leadership and direction to the Cyber Controls Specialist, ensuring the effective delivery of cyber controls management activities.

Controls Monitoring & Assurance

• Support compliance and regulatory activities by providing control evidence and demonstrating control effectiveness.
• Collaborate with assurance teams to align control monitoring activities with assurance programmes and remediation plans.
• Monitor control performance, identifying weaknesses, gaps or degraded controls and recommending corrective action.
• Evaluate control effectiveness against current and emerging cyber threats.
• Track the outcomes of control testing activities, including penetration testing, vulnerability assessments and security exercises, ensuring identified actions are progressed to completion.

Governance, Reporting & Stakeholder Engagement

• Attend governance forums and provide updates on control effectiveness, control coverage, remediation activities and emerging risks.
• Advise stakeholders on appropriate control selection and implementation in support of risk treatment activities.
• Prepare reports and dashboards for the CISO and senior leadership, communicating technical information in a clear and accessible manner.
• Maintain governance records, testing evidence and supporting documentation to an auditable standard.
• Work with programme and project teams to ensure security controls are embedded throughout the system lifecycle and considered within governance processes from the outset.

Knowledge & Skills:

• Strong understanding of cyber security control frameworks, including ISO 27001, and the principles of control design, implementation, assessment and governance.
• Ability to develop and maintain risk-to-control and requirement-to-control mappings, providing clear traceability across the cyber security landscape.
• Knowledge of preventive, detective, corrective and compensating controls, with the ability to assess both design adequacy and operational effectiveness.
• Experience presenting cyber security controls and risk information to senior stakeholders and governance forums. Strong leadership, communication and stakeho