Head of Governance, Risk and Compliance

National Energy System Operator

. Develop, implement and continually enhance NESO's security governance framework, threat-led cyber risk management framework and assurance strategy .

Posted 11/3/2026full-timeWokingham • United KingdomLead💰 £90,000 - £105,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in developing and implementing security governance frameworks, risk management strategies, and compliance programs aligned with NIS Regulations and ISO 27001. Proven ability to lead high-performing teams and foster a proactive security culture across technology and operational environments.

Highest-signal resume keywords

Cyber Security GovernanceRisk Management FrameworksNIS Regulations ComplianceISO 27001 ImplementationThreat Intelligence

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security Governance Framework DevelopmentThreat-Led Risk ManagementCyber Risk ReportingAssurance Strategy ImplementationControl FrameworksCompliance ActivitiesRisk AssessmentGovernance ProcessesEmerging Technology SecurityOperational Resilience Metrics

Soft Skills

LeadershipStakeholder EngagementProactive Risk CultureTeam BuildingCommunication

Tools & Technologies

DevSecOps PracticesCloud AdoptionDigital TransformationAI IntegrationThird-Party Ecosystems

Certifications & Qualifications

CISSPCISMCRISCISO 27001 Lead ImplementerNational Security Vetting Clearance

Industry Keywords

Critical National InfrastructureRegulatory ComplianceEnergy SectorNCSCOfgem

Tech Stack

Tools & technologies

CloudCyber Security

About the role

Key responsibilities & impact

Develop, implement and continually enhance NESO's security governance framework, threat-led cyber risk management framework and assurance strategy
Work with Executive stakeholders, the CIO leadership team, Enterprise Risk Management, Internal Audit, regulators and industry partners
Embed a proactive risk culture and integrate security into NESO's digital, operational and business transformation agenda
Lead development and evolution of the Security Governance Framework
Develop and maintain security policies, standards, control frameworks and governance processes across cyber, technology and operational environments
Advise the CISO on governance, risk and assurance matters
Operate the enterprise cyber risk management framework aligned to NIS Regulations, CAF, ISO 27001 and enterprise risk management processes
Drive threat-informed risk identification, assessment, prioritisation and treatment
Establish risk ownership and accountability across the organisation
Lead Board and Executive Committee cyber risk reporting
Provide independent challenge and assurance to major technology and business programmes
Develop and implement a cyber assurance strategy covering technology, operational environments, third parties and critical suppliers
Lead compliance activities relating to NIS Regulations, CAF, ISO27001 and other regulatory obligations
Manage relationships with regulators, auditors and external assurance providers
Establish metrics and reporting on control effectiveness and organisational resilience
Support digital, data, AI and technology transformation through governance, risk and assurance activities
Embed secure-by-design and risk-based decision-making into technology delivery, cloud adoption and DevSecOps practices
Provide oversight and challenge to major change programmes and emerging technology adoption, including AI
Lead and develop a high-performing Governance, Risk & Compliance function
Foster a proactive security culture and build relationships across operational, technology and business teams

Requirements

What you’ll need

Significant experience leading Cyber Security Governance, Risk and Compliance functions within critical national infrastructure, highly regulated or complex operational environments
Demonstrable experience designing and implementing enterprise security governance and threat-led risk management frameworks
Proven track record leading NIS Regulations and CAF compliance programmes
Experience providing cyber risk reporting and strategic advice to Boards, Executive Committees and regulators
Experience operating within digital transformation, cloud, data, AI and DevSecOps environments
Experience leading assurance activities across technology and third-party ecosystems
Strong understanding of modern cyber threats, threat intelligence and risk management methodologies
Experience building and leading high-performing teams
Energy sector experience desirable
Experience working closely with NCSC, Ofgem or other regulatory bodies desirable
CISSP, CISM, CRISC, ISO27001 Lead Implementer/Auditor or equivalent desirable
Experience developing governance, risk management and assurance approaches for emerging technologies, including Artificial Intelligence, Generative AI and advanced analytics, with understanding of associated security, ethical and regulatory considerations desirable
National Security Vetting (NSV) clearance required; usually resident in the UK for the last five years to apply for the required level of clearance
Right to work in the UK by the start of employment

Benefits

Comp & perks

Benefits allowance
Bonus of up to 20% of your salary for stretch performance
Private medical insurance
28 days annual leave as standard
Competitive contributory pension scheme with double-matched contributions up to a maximum company contribution of 12%
Flexible Bank Holidays & Holiday Trading
Additional Birthday Day Off
Cycle to Work Scheme
Retail & Gym Discounts
Critical Illness Insurance
Personal Accident Insurance
Hybrid working from office and home