Risk & Controls Manager (Cyber & Technology)

The Risk & Controls Manager (Cyber & Technology) supports the development, implementation and continuous improvement of SSE's cyber and technology risk and control framework. The role helps ensure that proportionate and effective risk management is embedded across IT, operational technology (OT), digital, data, cloud and third-party enabled services, taking account of the differing operational, safety, resilience and regulatory contexts across SSE businesses. 

Working with the Senior Technology Risk & Controls Manager and the wider Cyber Defence GRC team, the role translates enterprise risk requirements into practical delivery. It enables risks to be clearly articulated, consistently assessed and linked to controls, obligations, issues, incidents and remediation activity. The role also provides constructive challenge to management, helping to strengthen ownership, control effectiveness and risk maturity across the Group.

• Shape and improve how cyber and technology risks are managed, helping teams across the organisation identify, assess and respond to risks affecting technology, data, digital services and operational systems.

• Help people design and operate effective controls, providing practical advice and constructive challenge so that important risks are understood, controls are clear and any weaknesses are addressed.

• Turn risk and control information into useful insight, identifying trends, emerging concerns and areas of increasing exposure, and presenting clear reporting that supports informed decisions by senior leaders.

• Build trusted relationships across technical and business teams, making risk management easier to understand and apply while encouraging people to take ownership of their risks, controls and improvement actions.

• Lead and develop colleagues while improving ways of working, setting priorities, reviewing the quality of work and creating an inclusive environment where people can contribute, learn and deliver meaningful change.

• Practical experience of managing cyber, technology, operational, digital or information risks and controls in a complex organisation, with the ability to apply risk principles to real business situations.

• Strong analytical and problem-solving skills, including the ability to evaluate evidence, identify control weaknesses and emerging themes, and reach balanced, proportionate conclusions.

• Clear and inclusive communication skills, with the confidence to explain complex subjects in plain English, listen to different perspectives and constructively challenge stakeholders at all levels.

• The ability to build trusted relationships and deliver through others, working collaboratively across different teams, professional backgrounds and viewpoints to achieve shared outcomes.

• Experience of leading, coaching or developing others, combined with sound judgement, personal integrity and the ability to manage competing priorities in a changing environment.