Strategy and Governance Manager

Job Introduction

Job Description for Strategy and Governance Manager:

There’s never been a more exciting time to be part of the nuclear sector. New opportunities are being created all the time. At NNL, you’ll be in the ideal place to capitalise on this momentum, face new challenges and develop a long, successful and meaningful career. 

We’re an organisation that’s here to experiment and push the limits of what’s possible. So, if you’re keen to excel in your chosen field, this is the place to do it. Because at NNL, anything is possible.

The Strategy and Governance Manager is responsible to the Head of Security Strategy for the definition and timely and effective delivery of NNL's information security strategy, being informed by: 

• The assessment of information security capabilities and performance across NNL and our supply chain based on external interventions, internal audits and assurance activities. 
• The information security governance and reporting framework, which includes performance metrics, learning from experience and incidents. 

Whilst not responsible for conducting the Strategic Risk Review, this role will incorporate the agreed mitigation into the information security strategy and ensure these actions are completed as planned. 

The location for this role is flexible and can be based at Risley, Culham, Preston, Stonehouse and Sellafield.

Role Responsibility

Main Responsibilities for Strategy and Governance Manager:

• Provide effective and timely support for the Head of Security Strategy, deputising as required.  
• Engage NNL staff, suppliers and business partners in accordance with the CISO Function stakeholder engagement plan, becoming a trusted advisor and advocate for information security strategy, governance and compliance within the business and across the wider civil/defence nuclear sectors. 
• Support the CISO, SIRO and Executive Leadership Team in developing and maintaining a trusted and positive working relationship between NNL and our UK Regulators at the Office for Nuclear Regulation (ONR) and the Information Commissioner’s Office (ICO). 
• Enable the CISO to provide integrated, collaborative and professional leadership and governance for information security across NNL and our Supply Chain, built on a suitably resourced and performant operating model that meets our legal, regulatory and business needs. 
• Support the definition of NNL's information security strategy, being informed by a sound understanding of NNL’s legal and regulatory requirements; business priorities and risk appetite; information security and technology trends; and NNL’s current information security capabilities. 
• Manage a structured programme of second line information security assurance that is aligned to the security governance framework, driving delivery of the NNL information security strategy and measurable reductions in security risk; and taking effective action to resolve non-conformance. 

The Ideal Candidate

Essential Criteria for Strategy and Governance Manager:

• Demonstrable experience of leading small teams within organisations having similar characteristics to NNL (eg regulated organisations in the Nuclear Sector or other UK Critical National Infrastructure). 
• Manages the definition and implementation of a risk-adjusted Information Security strategy and associated development plans. 
• Contributes to the development and implementation of Information Security Governance processes, including reporting dashboards designed to improve decision-making and drive strategy delivery. 
• Supports engagement of executive risk owners/information asset owners to document mitigation plans, incorporating them in the strategic plans to ensure measurable reductions in risk. 
• Delivers business improvements through the application of Information Security, supporting the preparation of business cases to persuade senior stakeholders to invest in Information Security. 
• Manages and conducts audits of information security capabilities to monitor their compliance with the information security strategy and certification requirements (eg ISO 27001; Cyber Essentials).  
• Recognises and reports non-compliances with applicable legislation and regulation, recommending updates to Information Security policies and standards to comply with legislation and regulation. 
• Contributes to the development, revision, implementation or monitoring of personal data privacy policies and processes within an organisation. 
• Supports the production of Information Security requirements for third parties, which are aligned to security strategic objectives, conducting assurance reviews and visits to confirm compliance. 
• Contributes to Information Security incident policy and/or incident management and investigation procedures, ensuring alignment with the information security strategy, plans and certifications. 
• Ensures that colleagues understand how their work contributes to security of the department and organisation. 
• Ability to obtain SC level security clearance (this includes but is not limited to identity, employment, financial and criminal record checks plus 5 years’ worth of UK residency).

About the Company

NNL is an incredible place to work A place where people do things that have never been done before A place where people push boundaries to further themselves, the business, and society as a whole.

This is a place where personal and professional opportunities are limitless. If you want to change the world, if you want to tackle climate change, if you want to help advance medical science, if you want to help put things in space, if you want to answer the big questions, if you want to work with extraordinary materials, if you want to meet great people, learn new skills, challenge yourself, work flexibly, and build a long successful career with the power to make a real impact… you can do it all here.

NNL has a vision for Equality, Diversity, and Inclusivity (ED&I) where NNL aims to be an inclusive workplace that attracts diverse talent through transparent and equal policies and procedures. We want you and the diverse mix of people that we employ, customers that we service, and stakeholders that we influence to feel valued. We encourage a workplace culture where everyone can thrive with a sense of belonging.

Recruitment Agency Notice

We operate a strict Preferred Supplier List (PSL) for the provision of recruitment services. Only agencies on our PSL may provide CVs and only when the role is released to them by our recruitment team. We will not accept unsolicited CVs from suppliers not currently on our PSL. We explicitly reserve the right to add candidate details from unsolicited CVs from non-PSL agencies into our own candidate database and to pursue/hire such candidate(s) without any obligation, financial or otherwise, to the agency concerned.

United Kingdom National Nuclear Laboratory