{"id":3741007,"url":"https://alion.io/job/kaluza-security-grc-lead-tl1","title":"Security GRC Lead TL1","company":{"id":51455,"name":"Kaluza","domain":"kaluza.com","url":"https://alion.io/company/kaluza","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":75,"open_postings":5,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":30,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bristol, United Kingdom","London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ISO 27001","optional":false},{"name":"ISO 42001","optional":false},{"name":"Platform Engineering","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-11-04T09:46:03Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-05T02:01:55Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Job title: Security GRC Lead\nLocation: London or Bristol\nLevel: TL1\nTeam: Security\nContract: Permanent\nReporting To: Head of Information Security\nPlease note: This role requires an existing right to work in the UK. We can’t offer visa sponsorship, but we review sponsorship role by role, so keep an eye on our careers site for future opportunities.\nAbout Kaluza\nKaluza is the Energy Intelligence Platform, turning energy complexity into seamless coordination. We help energy companies overcome today’s challenges while accelerating the shift to a clean, electrified future.\nOur platform orchestrates millions of real-time decisions across homes, devices, markets and grids. By combining predictive algorithms with human-centred design, Kaluza makes clean energy dependable, affordable and adaptive to everyday life.\nWith teams across Europe, Asia and Australia, and a joint venture with Mitsubishi Corporation in Japan, we power leading companies including OVO, AGL and ENGIE, as well as innovators like Volvo and Volkswagen.\nWhere in the world of Kaluza will I be working?\nYou'll be joining the Information & Cyber Security team, a core part of our Platform & Security Engineering organisation. Security at Kaluza isn't a silo - you'll work closely with colleagues across security engineering, identity and access management, platform engineering and enterprise technical services.\nAs the Security GRC Lead, you will serve as the accountable operational owner for Kaluza’s Security Governance, Risk, and Compliance capability. You will establish and maintain a unified Common Control Framework, lead regulatory and framework readiness (including SOC 2 Type 2, ISO 27001, and ISO 22301), and work with engineering teams to demonstrate effective implementation of controls.\nA core focus of this role is acting as the primary information security bridge to Kaluza’s central Risk & Compliance team. You will closely collaborate with them to assess the impact of evolving security and privacy regulations, ensuring regulatory risks are clearly quantified, actionable, and seamlessly integrated into the wider enterprise risk framework.\nWhat you will be doing\nRegulatory Impact & Horizon Scanning: Collaborate closely with the Risk & Compliance team to monitor, evaluate, and interpret emerging regulatory changes in the information security, privacy, and critical infrastructure domains.\n\nSecurity Impact Assessments: Translate complex regulatory developments into actionable security control requirements and risk assessments for Kaluza, specifically covering:\nSector & Critical Infrastructure Regulations: NIS2, AESCSF, NCSC Cyber Assessment Framework (CAF), and the UK Cyber Security and Resilience Bill.\n\nEmerging Tech & Governance Standards: AI management and governance expectations (ISO 42001).\n\nEnterprise Risk Integration: Partner with Risk & Compliance to ensure security and resilience risks, control gaps, and regulatory exposures seamlessly flow into and align with the enterprise risk management (ERM) framework. Maintain high data accuracy across the security risk register to support board-level visibility.\n\nCommon Control Framework: Design, build, and maintain a single Common Control Framework (anchored initially on ISO 27001 Annex A) mapped across all regulatory, framework, and client contractual requirements.\n\nStandards & Policy Suite: Help continuously improve Kaluza's security policy and standards library.\n\nContinuous Control Monitoring: Shift Kaluza from point-in-time evidence gathering to automated control monitoring using commercial GRC platforms (e.g., Vanta), making audit readiness a natural byproduct of daily operations.\n\nSOC 2 Type 2 Programme: Lead the gap assessment, control build-out, and sustained observation period required for Kaluza’s SOC 2 Type 2 commitment.\n\nStandards Maintenance: Oversee continuous alignment with ISO 27001 and ISO 22301 to prevent posture drift between annual audit cycles.\n\nGovernance Reporting: Draft security reporting for internal leadership committees and forums, ensuring alignment with enterprise-wide reporting standards set by Risk & Compliance.\n\nClient Security Assurance: Own client security reporting commitments and streamline response workflows for client questionnaires and external audits.\n\nExternal Partner Coordination: Direct and manage external GRC consultants (e.g., Cydea) to execute audit operations and supplier assessments efficiently.\n\nWhat you will have\nCore Framework Expertise: Hands-on experience implementing and managing ISO 27001, ISO 22301, and SOC 2 Type 2 frameworks.\n\nRegulatory Horizon Scanning: Sound understanding of UK/EU cybersecurity laws, critical infrastructure mandates (e.g., NIS2, CSRB, CAF), and emerging tech governance.\n\nTooling & Risk Management: Experience working with automated GRC platforms (e.g., Vanta, Drata) and managing risk registers aligned with enterprise risk taxonomies.\n\nCross-Functional Collaboration: Demonstrated experience partnering with enterprise Risk, Legal, or Compliance teams to analyze and operationalize complex regulatory requirements.\n\nWe would still encourage you to apply even if you don’t have experience of all of the above - we look for potential as much as skills fit.\n Leadership & communication\nYou’ll be…\nStrongly aligned with the principle of \"business value over compliance-for-its-own-sake\", focusing on practical, lean governance rather than administrative overhead.\n\nAble to build strong bridges across central Risk & Compliance, technical engineering teams, senior leadership, and enterprise clients.\n\nA proactive leader comfortable establishing an integrated GRC capability from design through to execution.\n\nA pragmatic decision-maker who takes into account the short & long-term commercial, people & process costs and consequences of those decisions\n\nAccomplished at influencing (within teams, as well as upwards and outwards), using a mixture of communications skills\n\nSkilled in bringing alignment, clarity of thought and direction to information security, compliance and engineering challenges\n\nWhy Join Kaluza in This Role?\nStrategic Enterprise Impact: You will shape how security governance interfaces with central Risk & Compliance, directly influencing Kaluza's posture across international energy markets.\nUnlocking Technical Innovation: Your work takes compliance administration away from senior engineers, enabling them to focus on core platform innovation like AI security architecture and multi-tenant scaling. You’ll leverage AI-assisted tooling to synthesize and reconcile control evidence from multiple operational systems with human oversight, helping us accelerate & innovate within the compliance domain.\nGrowth Capability: As the accountable owner of GRC, you will establish the foundation and build the business case for expanding the security GRC team as Kaluza scales.\nOur Values\nFive values guide how we work at Kaluza:\nPlay to win: Collective pride in decarbonising energy at scale.\n\nSolve the real problem: Cutting through complexity to focus on real-world outcomes.\n\nBuild trust every day: Consistency, transparency and doing what we say.\n\nOwn the outcome: Full accountability, wins and setbacks, without ego.\n\nGo further together: Collaboration, respect and different perspectives.\n\nOur Perks\nTime off and family: 26 days’ holiday, plus 26 weeks’ full pay for new parents with no qualifying service period\n\nHealth and security: Private medical insurance with virtual GP, life assurance, pension scheme, free mortgage advice and eye tests\n\nPay and flexibility: Discretionary bonus, a Flex Fund of 5% [of salary] to spend on the benefits you want most, retail discounts through Perks at Work\n\nGrowth and setup: Personal learning budget, home office budget\n\nClimate: Furthr, our climate action app\n\nCome as you are\nWe want to meet people from all walks of life. The more inclusive we are, the better our work will be, and we recognise talent on merit and potential. If you’re excited about the role but don’t tick every box, we’d still love to hear from you.\nFind out more on ourcareers page andLinkedIn. Our Applicant Data Protection Policy is here.","description_format":"text","description_chars":8140,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Health insurance","Home office"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Billing & Subscription Management","Smart Grid","Energy Management","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-11-04T11:44:25Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Skilled Worker, Senior or Specialist Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Skilled Worker; Global Business Mobility: Senior or Specialist Worker","cap_exempt":false,"checked_at":"2026-11-04T06:27:35+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":30,"reasons":["conf:3","win:early"],"computed_at":"2026-11-05T05:21:49Z"},"pay":null,"html_url":"https://alion.io/job/kaluza-security-grc-lead-tl1","json_url":"https://alion.io/job/kaluza-security-grc-lead-tl1.json","meta":{"generated_at":"2026-11-05T05:21:49Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6412,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":51455},"rest":"https://alion.io/mcp/rest/get_company?id=51455"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkaluza-security-grc-lead-tl1"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkaluza-security-grc-lead-tl1"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkaluza-security-grc-lead-tl1"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/kaluza-security-grc-lead-tl1\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkaluza-security-grc-lead-tl1"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3741007}},{"tool":"search_jobs","arguments":{"company":"kaluza.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3741007},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}