Risk + Governance Lead

Location: Glasgow

Salary: £48-60K (plus up to 10% bonus)

Hybrid working, Permanent

Help us create a better future, quicker. Scottish Power Energy Networks (SPEN) is embarking on a Cyber Security Transformation Programme. We are looking for a Cyber Risk Lead to help implement and manage the Cyber Risk Methodology across SPEN, and ensure that Cyber Security Policies, Frameworks, Rules, and Methodologies are well-designed and effectively communicated within the Business.

What you’ll be doing:

• The Cyber Risk Lead will be crucial in managing and mitigating cyber risks within SPEN.
• Responsibilities include maintaining the risk register, performing detailed risk assessments, and developing risk treatment plans.
• The role supports the Head of Governance, Risk, and Assurance in OT risk management and governance, contributing to the broader Cyber Risk function.
• The role also involves driving SPEN's security transformation to reduce risk, achieve NIS compliance, and enhance cyber resilience.
• Additionally, the Cyber Risk Lead will develop and implement cyber governance frameworks aligned with regulatory standards and industry best practices.
• The role requires proactive risk identification, fostering security awareness, and ensuring effective communication of cyber risk strategies across the organization.
• Collaboration with stakeholders such as control owners, risk owners, and regulators is essential to maintain and improve SPEN’s cyber security posture.

What you’ll bring:

• Knowledge and experience of Cyber Security, evidenced by industry qualifications (e.g., GICSP, CISSP, CISM).
• Experience in developing and leading Cyber Security Risk Management and Governance in organizations of similar scope and scale, preferably with global security management experience.
• Knowledge of cyber security risk assessment processes.
• Experience in writing Cyber Policies.
• Awareness of key legislation and regulation affecting IT and OT Cyber Security in energy utilities.
• Ability to maintain and update the risk register accurately.
• Expertise in conducting comprehensive risk assessments.
• Skills in developing risk treatment plans aligned with risk tolerance.
• Proficiency in preparing risk reports for senior management and stakeholders.
• Experience leading or participating in cyber risk forums.
• Capability to support NIS compliance activities, including assessments and reporting.
• Proficiency in developing and implementing cyber governance frameworks.

Why SP Energy Networks:

Part of the Iberdrola Group, we are a leading utility company supporting renewable energy growth and Scotland’s Net Zero ambitions by 2044. We invest heavily in our transmission network, connecting wind farms and other infrastructure, and offer diverse career opportunities within a global organization. Our commitment to inclusion, diversity, and social purpose underpins our operations. We welcome candidates from all backgrounds and are dedicated to providing support during recruitment for those with disabilities or special needs.