Security GRC Lead

Job title: Security GRC Lead

Location: London or Bristol 

Level: TL1

Team: Security 

Contract: Permanent

Reporting To: Head of Information Security 

Please note: This role requires an existing right to work in the UK. We can’t offer visa sponsorship, but we review sponsorship role by role, so keep an eye on our careers site for future opportunities.

About Kaluza

Kaluza is the Energy Intelligence Platform, turning energy complexity into seamless coordination. We help energy companies overcome today’s challenges while accelerating the shift to a clean, electrified future.

Our platform orchestrates millions of real-time decisions across homes, devices, markets and grids. By combining predictive algorithms with human-centred design, Kaluza makes clean energy dependable, affordable and adaptive to everyday life.

With teams across Europe, Asia and Australia, and a joint venture with Mitsubishi Corporation in Japan, we power leading companies including OVO, AGL and ENGIE, as well as innovators like Volvo and Volkswagen.

Where in the world of Kaluza will I be working? 

You'll be joining the Information & Cyber Security team, a core part of our Platform & Security Engineering organisation. Security at Kaluza isn't a silo — you'll work closely with colleagues across security engineering, identity and access management, platform engineering and enterprise technical services.

As the Security GRC Lead, you will serve as the accountable operational owner for Kaluza’s Security Governance, Risk, and Compliance capability. You will establish and maintain a unified Common Control Framework, lead regulatory and framework readiness (including SOC 2 Type 2, ISO 27001, and ISO 22301), and work with engineering teams to demonstrate effective implementation of controls.

A core focus of this role is acting as the primary information security bridge to Kaluza’s central Risk & Compliance team. You will closely collaborate with them to assess the impact of evolving security and privacy regulations, ensuring regulatory risks are clearly quantified, actionable, and seamlessly integrated into the wider enterprise risk framework.

Why Join Kaluza in This Role?

Strategic Enterprise Impact: You will shape how security governance interfaces with central Risk & Compliance, directly influencing Kaluza's posture across international energy markets.

Unlocking Technical Innovation: Your work takes compliance administration away from senior engineers, enabling them to focus on core platform innovation like AI security architecture and multi-tenant scaling. You’ll leverage AI-assisted tooling to synthesize and reconcile control evidence from multiple operational systems with human oversight, helping us accelerate & innovate within the compliance domain.

Growth Capability: As the accountable owner of GRC, you will establish the foundation and build the business case for expanding the security GRC team as Kaluza scales.

What you’ll do

• Working with Risk & Compliance to monitor emerging regulation and turn it into clear security control requirements and risk assessments, covering NIS2, AESCSF, the NCSC CAF, the UK Cyber Security and Resilience Bill and ISO 42001 for AI governance.
• Making sure security and resilience risks, control gaps and regulatory exposures feed into the enterprise risk framework, and keeping the security risk register accurate enough to give the board clear visibility.
• Designing and maintaining a single Common Control Framework, anchored on ISO 27001 Annex A and mapped across regulatory, framework and client contractual requirements, and improving our security policy and standards library.
• Moving us from point-in-time evidence gathering to automated control monitoring with GRC platforms such as Vanta, so audit readiness becomes a by-product of daily operations.
• Leading our SOC 2 Type 2 programme, from gap assessment and control build-out through the sustained observation period.
• Keeping us continuously aligned with ISO 27001 and ISO 22301, so our posture doesn’t drift between annual audits.
• Owning governance and client security reporting, streamlining questionnaire and audit responses, and directing external GRC partners such as Cydea on audits and supplier assessments.

What you’ll bring 

• Core Framework Expertise: Hands-on experience implementing and managing ISO 27001, ISO 22301, and SOC 2 Type 2 frameworks.
• Regulatory Horizon Scanning: Sound understanding of UK/EU cybersecurity laws, critical infrastructure mandates (e.g., NIS2, CSRB, CAF), and emerging tech governance.
• Tooling & Risk Management: Experience working with automated GRC platforms (e.g., Vanta, Drata) and managing risk registers aligned with enterprise risk taxonomies.
• Cross-Functional Collaboration: Demonstrated experience partnering with enterprise Risk, Legal, or Compliance teams to analyze and operationalize complex regulatory requirements.

We would still encourage you to apply even if you don’t have experience of all of the above - we look for potential as much as skills fit.

Our Values

Five values guide how we work at Kaluza:

• Play to win: Collective pride in decarbonising energy at scale.
• Solve the real problem: Cutting through complexity to focus on real-world outcomes.
• Build trust every day: Consistency, transparency and doing what we say.
• Own the outcome: Full accountability, wins and setbacks, without ego.
• Go further together: Collaboration, respect and different perspectives.

Our Perks

• Time off and family: 26 days’ holiday, plus 26 weeks’ full pay for new parents with no qualifying service period
• Health and security: Private medical insurance with virtual GP, life assurance, pension scheme, free mortgage advice and eye tests
• Pay and flexibility: Discretionary bonus, a Flex Fund of 5% [of salary] to spend on the benefits you want most, retail discounts through Perks at Work
• Growth and setup: Personal learning budget, home office budget
• Climate: Furthr, our climate action app

Come as you are

We want to meet people from all walks of life. The more inclusive we are, the better our work will be, and we recognise talent on merit and potential. If you’re excited about the role but don’t tick every box, we’d still love to hear from you.

Find out more on our careers page and LinkedIn. Our Applicant Data Protection Policy is here.