Service Compliance Engineer

Overall purpose of the job:

Reporting to the CNI Service Assurance and Orchestration Manager, the overall purpose of the role is to:

• Support regulatory compliance within the scope of Operational Technology (OT) and Information Technology (IT) support services provided by the Vysiion Critical National Infrastructure (CNI) Centre of Excellence (CoE)
• Provide specific guidance on the operational implementation of controls to support compliance against the following:
  • ISO 27001 – Security Management
  • Cyber Assessment Framework (CAF)
  • Network Information Systems (NIS)
  • Center for Internet Security (CIS) Benchmarks
  • IEC 62443

Key responsibilities for this job:

1. Governance

• Define and maintain operational policies, standards, and procedures for compliance against OT and IT security frameworks
• Provide technical compliance guidance to project and engineering teams during new builds and ongoing operations.
• Support the handover and implementation of compliance processes, procedures and controls within operational engineering teams, as part of service implementation or transition

1. Risk Management

• Identify, assess, and prioritise and compliance risks associated with new implementation projects and existing supported systems.
• Map compliance framework objectives to technical controls within the scope of supported assets under contract.
• Review and update controls based on regular assessment.

1. Compliance

• Ensure adherence to regulatory frameworks (e.g., CAF, ISO, CIS, IEC 62443).
• Ensure adherence to customer contractual compliance obligations.
• Coordinate audits and manage compliance reporting.

1. Control Framework

• Define technical compliance controls for projects and operational environments.
• Validate implementation of compliance controls during build phases and monitor effectiveness during support phases.

1. Monitoring & Reporting

• Implement continuous monitoring processes for compliance and risk indicators.
• Provide regular customer aligned reports on compliance status.
• Any other fair and reasonable task or duty assigned to you by your manager, or other senior Vysiion or Exponential-e Ltd staff member

Knowledge and experience required:

• Strong knowledge of regulatory standards and industry frameworks, including:
  • Center for Internet Security (CIS) benchmarking
  • Network and Information Systems (NIS)
  • National Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF)
  • ISO Standards – particularly ISO27001 (Information Security Management)
  • IEC 62443 – especially risk management elements
• Expertise in risk assessment methodologies and compliance management tools.
• Excellent communication and stakeholder engagement skills.
• Experience of implementation/governance of technical compliance regimes in an operational context – ideally within an OT environment
• Working knowledge of some or all the following technology types:
  • Server operating systems
  • Networking
  • Firewalling
  • Virtualisation
  • Endpoint devices
  • Encryption
  • Anti-virus and malware
  • Vulnerability Management
  • Security information and event management (SIEM)
  • Intrusion Detection and Prevention systems (IDS and IPS)