Security Assurance Manager

INTERNAL JOB TITLE: CYBER SECURITY ASSURANCE SPECIALIST

UKAEAs mission is to lead the delivery of sustainable fusion energy and maximise scientific and economic impact. The Computing Division underpins this mission by delivering secure scalable and innovative digital solutions.
The Cyber Security Assurance Specialist plays a pivotal role in advancing UKAEA s hybrid digital estate encompassing enterprise IT operational technology (OT) and research platforms. This role sits within the Information & Cyber Security Group and provides subject matter expertise in security architecture cyber risk governance and assurance frameworks.

This is a cross-functional role with both advisory and hands-on responsibilities focusing on security assurance risk management and supporting architecture reviews vulnerability management risk assessments cyber defence posture driving technical assurance and embedding risk-aligned security controls across IT and OT systems and secure-by-design practices. You will work across hybrid environments including cloud infrastructure applications and OT systems. You will be responsible for designing and advising on security architecture patterns reviewing and maintaining risk registers leading assurance assessments and embedding security controls across infrastructure and platforms. You will also guide teams in applying secure-by-design principles and support both internal audit and external compliance efforts including Gov Assure CAF ISO 27001 and Cyber Essentials (CE and CE) while supporting the secure operation of core services. The role requires strong stakeholder engagement technical depth and a sound understanding of UK-specific cyber risk frameworks. You will help shape and maintain a secure posture across UKAEA.
Key Accountabilities
Conduct technical risk assessments on IT/OT/cloud systems
Provide secure design guidance to digital projects (cloud/infra/app)
Maintain and update the security risk register quarterly
Evaluate 2 critical technical changes for architectural risk (e.g. network reconfig app onboarding)
Document evidence gathering and remediation planning for Secure-by-designCAF and GovAssure
Conduct internal technical assurance reviews aligned to GovAssure/CAF/ISO27001 domains
Maintain traceability of security controls to frameworks (NIST CE NCSC)
Evaluate Suppliers against internal and external risk criteria for Assurance.
Contribute to the adoption of Zero Trust principles in platform design
Provide secure-by-design input into infrastructure/cloud/app initiatives
Define security control templates for new deployments (e.g. SaaS Azure service OT upgrade)
Deliver knowledge sessions to technical teams (secure config threats compliance)
Develop secure configuration guidance for platforms (e.g. Entra ID Linux M365)
Represent Cyber Security in architecture/design authorities
Produce and maintain technical security reports for assurance cycles
Support compliance audit evidence packs (GovAssure/CAF CE ISO 27001)
Develop or update security standard documents (e.g. threat modelling vulnerability mgmt)
Support cyber input for IT research or OT programmes
Work with IT teams to co-author and test secure configuration standards and playbooks
Support security policy application in hybrid cloud infra and app settings
Support audit and compliance activities with reporting and evidence gathering