IT and Cyber Security Manager

IT & Cyber Security Manager

Ferrovial BAM JV has a strong track record of delivering major UK infrastructure projects and is now responsible for the track infrastructure across the full HS2 route.

Responsibilities

• Lead and develop the IT and Cyber Security function in line with business, project and operational requirements.
• Define and implement the UK & Ireland IT and Cyber Security strategy, ensuring alignment with corporate standards across business units, subsidiaries, projects and joint ventures.
• Establish and maintain appropriate cybersecurity governance, controls, policies and standards, ensuring they remain effective throughout the lifecycle of IT systems, digital products and services.
• Manage the setup, implementation and ongoing operation of project IT and cybersecurity infrastructure, including networks, cloud environments and associated technology services.
• Oversee cybersecurity risk management, identifying vulnerabilities and ensuring appropriate mitigation measures are implemented and monitored.
• Lead IT and cybersecurity projects, including new system implementations, technology deployments, benchmarking and proof-of-concept initiatives.
• Manage Microsoft 365, Share Point and cloud services, ensuring appropriate security, accessibility and governance.
• Oversee IT procurement, software licensing, supplier contracts and third-party technology and cybersecurity providers.
• Manage cybersecurity requirements within supplier and joint venture agreements, ensuring appropriate contractual controls and security standards are in place.
• Maintain effective data governance, backup, disaster recovery and business continuity arrangements.
• Ensure compliance with relevant cybersecurity standards and frameworks, including Cyber Essentials Plus, ISO 27001 and SOX controls.
• Support cybersecurity incident management, investigations and remediation activities.
• Manage IT budgets, technology assets and associated cost controls.
• Identify and deliver opportunities to improve efficiency through AI, automation and systems integration.
• Provide on-site technical support and escalation where issues cannot be resolved through the Service Desk.
• Support risk management and internal audit activities, providing evidence and assurance on IT and cybersecurity controls.
• Monitor and report on cybersecurity posture, compliance, risks and key project milestones to senior stakeholders.
• Manage and develop IT engineers, analysts and third-party providers, including teams operating across different locations.
• Promote cybersecurity awareness across the business through appropriate communication, guidance and training.
• Identify opportunities to enhance IT and cybersecurity services across the UK & Ireland business, projects, subsidiaries and joint ventures.

Qualifications

Education & Experience

Master’s degree in Computer Science, Engineering, Information Technology or a related discipline, or equivalent professional experience.

Previous experience managing complex IT and cybersecurity environments across the full lifecycle.

Previous experience within the construction, infrastructure and/or utilities sectors is preferred.

Strong experience defining, implementing and improving cybersecurity strategies, governance frameworks and risk management models within large or complex organisations.

Experience designing, implementing and assessing security architecture, infrastructure and services across enterprise environments.

Strong knowledge of OT, ICS and Io T cybersecurity, including ISA/IEC 62443, the Purdue Model and defence-in-depth principles.

Practical experience with recognised security frameworks and standards, including ISO 27001, NIST Cybersecurity Framework and Cyber Essentials Plus.

Knowledge of regulatory and compliance requirements and the ability to identify, assess and manage associated cybersecurity risks.

Understanding of modern security architecture principles, including Zero Trust and SASE.

Experience in cybersecurity incident management, business continuity, disaster recovery and security assurance.

Experience conducting or supporting cybersecurity audits, risk assessments and security reviews.

Experience managing IT infrastructure, Microsoft 365, Share Point, cloud services, networks and technology suppliers.

Experience managing technology budgets, procurement, licensing and IT assets.

Experience leading IT and cybersecurity teams and managing third-party service providers.

Professional Skills & Certifications

Relevant professional certifications such as CISSP, CISM, CISA, ISO 27001 or SANS/GIAC qualifications are desirable.

Strong stakeholder management and communication skills, with the ability to communicate technical cybersecurity matters clearly to both technical and non-technical audiences.

Strong commercial and negotiation skills, particularly when managing supplier contracts and cybersecurity requirements.

Ability to lead and coordinate teams across multiple projects and locations, including remote and international teams.

Strong organisational and prioritisation skills, with the ability to manage multiple workstreams and deadlines.

Proactive and solutions-focused approach, with strong analytical and problem-solving skills.

Excellent written and spoken English, including the ability to lead meetings and deliver presentations confidently