kaluza - Security GRC Lead TL1

• Regulatory Impact & Horizon Scanning: Collaborate closely with the Risk & Compliance team to monitor, evaluate, and interpret emerging regulatory changes in the information security, privacy, and critical infrastructure domains. • Security Impact Assessments: Translate complex regulatory developments into actionable security control requirements and risk assessments for Kaluza, specifically covering: • Sector & Critical Infrastructure Regulations: NIS2, AESCSF, NCSC Cyber Assessment Framework (CAF), and the UK Cyber Security and Resilience Bill. • Emerging Tech & Governance Standards: AI management and governance expectations (ISO 42001). • Enterprise Risk Integration: Partner with Risk & Compliance to ensure security and resilience risks, control gaps, and regulatory exposures seamlessly flow into and align with the enterprise risk management (ERM) framework. Maintain high data accuracy across the security risk register to support board-level visibility. • Common Control Framework: Design, build, and maintain a single Common Control Framework (anchored initially on ISO 27001 Annex A) mapped across all regulatory, framework, and client contractual requirements. • Standards & Policy Suite: Help continuously improve Kaluza's security policy and standards library. • Continuous Control Monitoring: Shift Kaluza from point-in-time evidence gathering to automated control monitoring using commercial GRC platforms (e.g., Vanta), making audit readiness a natural byproduct of daily operations. • SOC 2 Type 2 Programme: Lead the gap assessment, control build-out, and sustained observation period required for Kaluza’s SOC 2 Type 2 commitment. • Standards Maintenance: Oversee continuous alignment with ISO 27001 and ISO 22301 to prevent posture drift between annual audit cycles. • Governance Reporting: Draft security reporting for internal leadership committees and forums, ensuring alignment with enterprise-wide reporting standards set by Risk & Compliance. • Client Security Assurance: Own client security reporting commitments and streamline response workflows for client questionnaires and external audits. • External Partner Coordination: Direct and manage external GRC consultants (e.g., Cydea) to execute audit operations and supplier assessments efficiently. • Core Framework Expertise: Hands-on experience implementing and managing ISO 27001, ISO 22301, and SOC 2 Type 2 frameworks. • Regulatory Horizon Scanning: Sound understanding of UK/EU cybersecurity laws, critical infrastructure mandates (e.g., NIS2, CSRB, CAF), and emerging tech governance. • Tooling & Risk Management: Experience working with automated GRC platforms (e.g., Vanta, Drata) and managing risk registers aligned with enterprise risk taxonomies. • Cross-Functional Collaboration: Demonstrated experience partnering with enterprise Risk, Legal, or Compliance teams to analyze and operationalize complex regulatory requirements. • We would still encourage you to apply even if you don’t have experience of all of the above - we look for potential as much as skills fit. • Leadership & communication • Strongly aligned with the principle of "business value over compliance-for-its-own-sake", focusing on practical, lean governance rather than administrative overhead. • Able to build strong bridges across central Risk & Compliance, technical engineering teams, senior leadership, and enterprise clients. • A proactive leader comfortable establishing an integrated GRC capability from design through to execution. • A pragmatic decision-maker who takes into account the short & long-term commercial, people & process costs and consequences of those decisions • Accomplished at influencing (within teams, as well as upwards and outwards), using a mixture of communications skills • Skilled in bringing alignment, clarity of thought and direction to information security, compliance and engineering challenges • Strategic Enterprise Impact: You will shape how security governance interfaces with central Risk & Compliance, directly influencing Kaluza's posture across international energy markets. • Unlocking Technical Innovation: Your work takes compliance administration away from senior engineers, enabling them to focus on core platform innovation like AI security architecture and multi-tenant scaling. You’ll leverage AI-assisted tooling to synthesize and reconcile control evidence from multiple operational systems with human oversight, helping us accelerate & innovate within the compliance domain. • Growth Capability: As the accountable owner of GRC, you will establish the foundation and build the business case for expanding the security GRC team as Kaluza scales. • Five values guide how we work at Kaluza: • Play to win: Collective pride in decarbonising energy at scale. • Solve the real problem: Cutting through complexity to focus on real-world outcomes. • Build trust every day: Consistency, transparency and doing what we say. • Own the outcome: Full accountability, wins and setbacks, without ego. • Go further together: Collaboration, respect and different perspectives.