Information Security & Cyber Security Officer

About the role

The Civil Works Alliance (CWA) is delivering the Sizewell C nuclear power station, a 3.2‑GW low‑carbon project for around 6 million homes. As an Information Security & Cyber Security Officer you will protect this strategically important infrastructure by establishing and maintaining a robust cyber security posture and ensuring compliance with UK government standards.

Key responsibilities

• Deputise for the Information Security Manager and drive the cyber security agenda across the Alliance.
• Serve as the single point of contact for all information and cyber security matters.
• Establish, agree and maintain the Alliance security posture aligned to ISO 27001 and UK Cyber Essentials.
• Create and contribute to security principles, standards and execution plans.
• Schedule, interpret and act on penetration testing results, prioritising mitigations.
• Lead regular vulnerability assessments and close identified security gaps.
• Implement and monitor cyber security controls in collaboration with the broader security team.
• Perform Data Protection Officer duties, including assisting with Data Protection Impact Assessments.
• Host security meetings with stakeholders to discuss incidents, risks and regulatory changes.
• Develop and deliver information security training and awareness programmes.
• Collaborate with client, partner CISOs, CWA IT team and supplier security teams.
• Feed security intelligence into the Alliance risk register and lead rapid response to malicious activity.

Required profile

• Senior security professional with experience protecting large‑scale infrastructure projects.
• Strong knowledge of UK government security standards and regulatory requirements.
• Proven ability to work with senior stakeholders and cross‑functional teams.
• Excellent analytical skills and up‑to‑date awareness of emerging cyber threats.

Required skills

• ISO 27001
• UK Cyber Essentials
• PAS 1192:2
• UK GDPR
• Penetration testing
• Vulnerability assessment
• Security controls implementation
• Data Protection Impact Assessments