Cyber Risk Assessment Lead

Sizewell C is entering an exciting phase of growth as we mature into an independent organisation and continue building one of the UK’s largest and most important energy projects. We are now recruiting the below position:

Active Security Clearance is required and must already be in place

London, Leiston or Ipswich, with hybrid working and a minimum of 2 days per week on-site. Travel to other Sizewell C locations may be required.

Permanent, full-time

• Annual Leave: 28 days per annum, increasing to 30 days after 5 years of service, plus bank holidays
• Bonus: 5% annual bonus
• Pension Contributions: Defined Contribution Pension Scheme with up to 7.5% employee contribution 15% employer contribution
• Life Assurance: Up to 8 x salary

1st October 2026

The Cyber Risk Assessment Lead plays a key role in shaping and embedding Sizewell C's cyber risk assessment capability across the organisation.

Reporting into the Cyber Risk Manager, you will own and evolve the cyber risk assessment methodology, ensuring risks are identified, accessed and communicated consistently across the business. You will be responsible for maintaining assessment standards, overseeing the delivery pipeline and ensuring cyber risk assessments remain aligned with industry best practice and regulatory expectations.

Leading the day-to-day activities of the Cyber Risk Specialist and Cyber Risk Analyst, you will provide technical guidance, quality assurance and oversight of cyber risk assessments, helping ensure risk-informed decision making across one of the UK's most significant infrastructure projects.

• Own and maintain the organisation's cyber risk assessment methodology, standards, tooling and quality framework.
• Drive continuous improvement of cyber risk assessment practices, incorporating lessons learned, emerging threats and industry best practice.
• Promote consistent adoption of cyber risk assessment processes across the organisation.
• Establish and maintain assessment criteria that ensure risks are evaluated and reported consistently.
• Ensure identified risks, control gaps and requirement shortfalls are appropriately documented and escalated through established risk management processes.
• Manage the pipeline of Security Risk Assessments (SRAs), ensuring assessments are prioritised, planned and delivered effectively.
• Provide leadership and direction to the Cyber Risk Specialist and Cyber Risk Analyst.
• Coordinate third-party support for cyber risk assessments where required.
• Review and quality assure assessment outputs to ensure consistency, accuracy and compliance with organisational standards.
• Lead complex, sensitive or high-impact cyber risk assessments and provide technical support to wider team members.
• Lead, develop and support the Cyber Risk Specialist and Cyber Risk Analyst, ensuring a consistent and effective approach to cyber risk assessment across the organisation.
• Support the Cyber Risk Manager in maintaining a current and accurate cyber risk position across the organisation.
• Ensure assessment findings are translated into actionable risk management outcomes and appropriately reflected within the cyber risk register.
• Contribute to the tracking and reporting of identified cyber risks and mitigation activities.
• Support integration between cyber risk management and wider enterprise risk management processes.
• Assist with business impact assessments, threat modelling exercises and risk analysis activities.

• Collaborate with Security Operations teams to ensure threat intelligence is incorporated into cyber risk assessments.
• Work closely with cyber security, digital and business teams to identify emerging risks and assess potential impacts.
• Produce clear and effective risk reports, dashboards and management information for leadership and governance forums.
• Present cyber risk assessment findings to both technical and non-technical stakeholders.
• Provide expert advice on cyber risk assessment approaches and methodologies across the organisation.

• Strong understanding of cyber security risk assessment principles, frameworks and methodologies.
• Knowledge of recognised approaches such as ISO 27005, NIST Risk Management Framework (RMF), FAIR, OCTAVE or equivalent methodologies.
• Ability to design, implement and maintain effective cyber risk assessment processes within a complex and regulated environment.
• Strong understanding of threat identification,…