Job details
Job title: Security GRC Lead
Location: London or Bristol
Level: TL1
Team: Security
Contract: Permanent
Reporting To: Head of Information Security
Please note: This role requires an existing right to work in the UK. We can't offer visa sponsorship, but we review sponsorship role by role, so keep an eye on our careers site for future opportunities.
About Kaluza
Kaluza is the Energy Intelligence Platform, turning energy complexity into seamless coordination. We help energy companies overcome today's challenges while accelerating the shift to a clean, electrified future.
Our platform orchestrates millions of real-time decisions across homes, devices, markets and grids. By combining predictive algorithms with human-centred design, Kaluza makes clean energy dependable, affordable and adaptive to everyday life.
With teams across Europe, Asia and Australia, and a joint venture with Mitsubishi Corporation in Japan, we power leading companies including OVO, AGL and ENGIE, as well as innovators like Volvo and Volkswagen.
Where in the world of Kaluza will I be working?
You'll be joining the Information & Cyber Security team, a core part of our Platform & Security Engineering organisation. Security at Kaluza isn't a silo - you'll work closely with colleagues across security engineering, identity and access management, platform engineering and enterprise technical services.
As the Security GRC Lead, you will serve as the accountable operational owner for Kaluza's Security Governance, Risk, and Compliance capability. You will establish and maintain a unified Common Control Framework, lead regulatory and framework readiness (including SOC 2 Type 2, ISO 27001, and ISO 22301), and work with engineering teams to demonstrate effective implementation of controls.
A core focus of this role is acting as the primary information security bridge to Kaluza's central Risk & Compliance team. You will closely collaborate with them to assess the impact of evolving security and privacy regulations, ensuring regulatory risks are clearly quantified, actionable, and seamlessly integrated into the wider enterprise risk framework.
What you will be doing
- Regulatory Impact & Horizon Scanning: Collaborate closely with the Risk & Compliance team to monitor, evaluate, and interpret emerging regulatory changes in the information security, privacy, and critical infrastructure domains.
- Security Impact Assessments: Translate complex regulatory developments into actionable security control requirements and risk assessments for Kaluza, specifically covering:
- Sector & Critical Infrastructure Regulations: NIS2, AESCSF, NCSC Cyber Assessment Framework (CAF), and the UK Cyber Security and Resilience Bill.
- Emerging Tech & Governance Standards: AI management and governance expectations (ISO 42001).
- Enterprise Risk Integration: Partner with Risk & Compliance to ensure security and resilience risks, control gaps, and regulatory exposures seamlessly flow into and align with the enterprise risk management (ERM) framework. Maintain high data accuracy across the security risk register to support board-level visibility.
- Common Control Framework: Design, build, and maintain a single Common Control Framework (anchored initially on ISO 27001 Annex A) mapped across all regulatory, framework, and client contractual requirements.
- Standards & Policy Suite: Help continuously improve Kaluza's security policy and standards library.
- Continuous Control Monitoring: Shift Kaluza from point-in-time evidence gathering to automated control monitoring using commercial GRC platforms (e.g., Vanta), making audit readiness a natural byproduct of daily operations.
- SOC 2 Type 2 Programme: Lead the gap assessment, control build-out, and sustained observation period required for Kaluza's SOC 2 Type 2 commitment.
- Standards Maintenance: Oversee continuous alignment with ISO 27001 and ISO 22301 to prevent posture drift between annual audit cycles.
- Governance Reporting: Draft security reporting for internal leadership committees and forums, ensuring alignment with enterprise-wide reporting standards set by Risk & Compliance.
- Client Security Assurance: Own client security reporting commitments and streamline response workflows for client questionnaires and external audits.
- External Partner Coordination: Direct and manage external GRC consultants (e.g., Cydea) to execute audit operations and supplier assessments efficiently.
What you will have
- Core Framework Expertise: Hands-on experience implementing and managing ISO 27001, ISO 22301, and SOC 2 Type 2 frameworks.
- Regulatory Horizon Scanning: Sound understanding of UK/EU cybersecurity laws, critical infrastructure mandates (e.g., NIS2, CSRB, CAF), and emerging tech governance.
- Tooling & Risk Management: Experience working with automated GRC platforms (e.g., Vanta, Drata) and managing risk registers aligned with enterprise risk taxonomies.
- Cross-Functional Collaboration: Demonstrated exp
#J-18808-Ljbffr
Security GRC Lead TL1 employer: Kaluza
Kaluza is an exceptional employer, offering a dynamic work environment in London that fosters innovation and collaboration within the energy sector. With a strong commitment to employee growth, Kaluza provides a range of benefits including a personal learning budget, flexible holiday options, and a progressive leave policy, ensuring that team members can thrive both personally and professionally. The company's focus on diversity and merit-based talent recognition makes it an attractive place for those seeking meaningful and rewarding careers in business development.
