Information Security & Data Governance Lead (UK)

Principal Accountabilities

Information Security

• Develop, implement, and maintain information and cyber security policies, standards, and procedures
• Ensure alignment with recognized frameworks (ISO 27001, NIST CSF, CIS Controls)
• Conduct risk assessments across IT, cloud, and Operational Technology (OT) environments
• Support incident response planning and continuous improvement of security controls
• Embed secure-by-design principles into infrastructure and operational systems

Data Governance

• Establish and maintain an enterprise data governance framework
• Define and enforce data classification, handling, retention, and protection standards
• Ensure compliance with international data protection regulations including GDPR, UK Data Protection Act, and applicable US privacy laws
• Promote data ownership, stewardship, and accountability across business units
• Support data quality, integrity, and lifecycle management

Compliance & Regulatory Oversight

• Ensure compliance with applicable cybersecurity, data governance, and energy sector regulations
• Lead and support internal and external audit activities, including evidence collection and remediation tracking
• Maintain enterprise risk registers and compliance reporting
• Continuously monitor global cyber and data regulatory changes
• Assess impact of regulatory developments and update internal policies, standards, and procedures accordingly
• Ensure compliance is maintained across all regions of operation

Cybersecurity Awareness & Training

• Design and deliver enterprise cybersecurity awareness programmes
• Conduct phishing simulations and risk-based awareness campaigns
• Tailor training for corporate and operational (OT) environments
• Measure effectiveness and drive continuous improvement in user behaviour

Governance & Advisory

• Act as subject matter expert and advisor on security, governance, and compliance matters
• Administer and support third-party/vendor risk management programme
• Provide reporting and insights to leadership on security posture, regulatory changes, and risk exposure
• Contribute to the continuous improvement of governance, risk, and compliance (GRC) capability
• Member of change management board and contributor to change management process

Qualifications and Experience

Required

• Significant experience in information security, cybersecurity GRC, or IT governance roles
• Proven experience implementing data governance frameworks
• Strong understanding of international data protection and cybersecurity regulations

JOB DESCRIPTION

• Experience working within regulated environments
• Familiarity with ISO 27001, NIST, or equivalent frameworks
• Experience supporting audit and compliance processes

Desired

• Experience in the energy, utilities, or critical infrastructure sector
• Exposure to Operational Technology (OT) environments
• Professional certifications (e.g., CISSP, CISM, CRISC, CISA, CDMP)
• Experience with GRC tools (e.g., ServiceNow GRC, RSA Archer, MetricStream)

HSE Responsibilities

• Stop work by challenging and stopping unsafe acts and behaviours or unsafe conditions.
• Comply with Standard Operating Procedures defined in Responsibilities above, and company STOP WORK

system.

• Ensure that cybersecurity considerations support safe and reliable operational environments, particularly

within OT systems

Competencies

• Risk & Compliance Expertise: Strong understanding of regulatory and governance frameworks
• Analytical Thinking: Ability to assess and mitigate complex risks
• Stakeholder Engagement: Ability to influence across technical and business teams
• Communication: Clear communication of technical and regulatory requirements
• Autonomy: Operates independently with accountability for outcomes
• Continuous Improvement: Proactively adapts to changing regulatory and threat landscapes

Any Other Information

• This is a senior individual contributor role with no direct reports
• The role operates across multiple jurisdictions with varying regulatory requirements