Regulatory Cyber Assurance Principal

Protect Great Britain's Critical Energy Infrastructure

At Ofgem, we work on behalf of energy consumers to ensure every household and business across Great Britain can rely on a safe, affordable and environmentally sustainable energy supply.

As Great Britain's energy system continues to evolve, cyber resilience plays a critical role in maintaining secure and reliable services. Through our responsibilities under the Network and Information Systems (NIS) Regulations, Ofgem acts as the Competent Authority for the Downstream Gas and Electricity (DGE) sector, helping ensure operational systems and networks remain resilient against cyber and related security threats.

We're looking for two experienced Regulatory Cyber Assurance Principals to join our Cyber Regulation team on a permanent basis. This is an opportunity to play a leading role in protecting critical national infrastructure, working directly with Operators of Essential Services (OES), government partners and industry stakeholders to strengthen cyber resilience across the energy sector.

As Ofgem's Cyber Assurance expert, you will lead and maintain relationships across a designated portfolio of Operators of Essential Services (OES), delivering a regulatory model that is engaging, collaborative and focused on improving cyber resilience.

You will provide leadership on cyber assurance activities across the Downstream Gas and Electricity sector, assessing compliance with the NIS Regulations, making expert compliance determinations and advising on appropriate regulatory responses where concerns or breaches are identified.

Working at the intersection of cyber security, regulation and critical national infrastructure, you will conduct assurance activities including inspections, review audit, exercising and technical testing outcomes, while influencing improvements that help safeguard services relied upon by millions of consumers across Great Britain.

Key Responsibilities

• Lead and maintain relationships across a designated portfolio of Operators of Essential Services (OES).
• Provide expert advice and guidance to the DGE sector on compliance with the NIS Regulations.
• Lead and support regulatory assurance and engagement activities, ensuring alignment with regulatory expectations.
• Contribute to and lead NIS inspections, including evidence reviews, on-site assessments and the production of high-quality inspection reports.
• Review and assess compliance documentation, including assurance reports, audit findings, exercising and testing outcomes, remediation plans and incident reports.
• Assess and make expert determinations on compliance with the NIS Regulations.
• Document inspection outcomes, assurance findings and regulatory decisions accurately and consistently.
• Escalate compliance concerns where appropriate and collaborate with Enforcement teams to support the application of regulatory tools and drive improvements.
• Provide expert advice regarding enforcement action where NIS Regulations have been breached.
• Lead the development and continuous improvement of cyber assurance policies, products, methodologies and regulatory approaches.
• Work collaboratively with government departments, other Competent Authorities, industry stakeholders and external assurance providers to support resilience objectives.
• Provide inclusive leadership through knowledge sharing, coaching and support across the Cyber Regulation team, contributing to Ofgem's values and culture.

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours and Experience.

When you press the ‘Apply now’ button, you will be asked to complete personal details (not seen by the sift panel), your career history and qualifications.

You will then be asked to provide a 1250 word ‘personal statement’ evidencing how you meet the essential skills and capabilities listed in the role profile. Please ensure you demonstrate clearly, within your supporting statement, how you meet each of the criteria listed in the role profile. In the event of receiving a large number of applications, an initial sift may take place on just the lead criteria indicated in the essential criteria.

The personal information we have collected from you will be shared with Cifas who will use it to prevent fraud, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct. If any of these are detected, you could be refused certain services or employment. Your personal information will also be used to verify your identity. Further details of how your information will be used by us and Cifas, and your data protection rights, can be found by [https://www.cifas.org.uk/fpn].

At Ofgem, we expect our staff to carry out their roles with honesty, fairness and openness. They should follow the Civil Service code and be free from any influence or bias. We are committed to making sure interests are recognised, declared and managed appropriately so that we can fulfil our duties as an energy regulator. Our Conflicts of Interest policy outlines the types of interests Ofgem staff must declare before onboarding, and the rules they must follow throughout employment so that we can clearly demonstrate that our decisions are not influenced by private interests.

Feedback will only be provided if you attend an interview or assessment.