Director – Cyber Controls Officer

Overview

• Act as the Cyber SME for controls, providing expert oversight and challenge across Cyber & Information Security and CISO on control effectiveness.
• Lead and support core cyber risk and control processes (e.g. RCSA, Interim RCSA, Issue Management, Key Indicators, Standards adherence), ensuring outputs are risk-based, consistent and aligned to regulatory expectations.
• Analyse and challenge cyber risk issues and control weaknesses, working with control owners to define and track sustainable remediation actions.
• Maintain end-to-end visibility of the cyber control environment, identifying emerging themes, systemic risks and areas requiring escalation to senior governance forums.
• Support delivery and oversight of key cyber programmes (e.g. Cyber Excellence Programme, Risk Reduction Plan), ensuring clear linkage to control outcomes and risk reduction.
• Support regulatory meetings and interactions, including preparation of materials, providing SME input, and contributing to responses to regulatory requests and findings.
• Engage with 2
  
  LoD, Internal Audit and regulators on cyber-related matters, supporting reviews and ensuring timely, high-quality responses to findings.
• Maintain up-to-date knowledge of cyber threats, regulatory developments and industry best practice, applying this to strengthen the cyber control environment.

• Significant experience in Cyber Security, Information Security Risk, or Cyber Controls, ideally within a large, complex financial services organisation.
• Strong understanding of cyber risk and control processes (e.g. RCSA, Interim RCSA, Issue Management, Key Indicators) and their practical application.
• Good knowledge of cyber security frameworks and standards (e.g. NIST, ISO 27001) and their implementation in enterprise environments.
• Proven ability to assess cyber control effectiveness, identify root causes and drive sustainable remediation of control weaknesses.
• Experience engaging and influencing senior stakeholders across Cyber, Risk and Control functions, providing credible challenge in a matrix environment.
• Strong analytical and communication skills, with the ability to translate complex cyber risks into clear, concise and actionable insight for senior audiences.