SPEN are looking for an Awareness, Behaviour, and Culture Skills Lead to join their cyber security team based in Glasgow.
ABC (Awareness, Behaviour, and Culture) Skills Lead
Scottish Power Energy Networks - Cyber Security
12 month initial contract with scope of renewal
Glasgow/hybrid style working
Full time, Mon - Fri
Inside IR35, PAYE and Umbrella options available
Role Purpose:
The Awareness, Behaviour and Skills Lead will be responsible for developing, implementing and continuously improving SPENs cyber security awareness, behaviour change and skills development programmes across employees, contractors and third parties.
The role will lead the design and delivery of initiatives that strengthen cyber security culture, reduce human-related cyber risks, and improve the cyber capabilities required to support SPENs strategic, operational and regulatory objectives.
A key responsibility will be to lead the development and implementation of cyber skills frameworks, competency models, learning pathways and capability assessments, ensuring that SPEN has the cyber skills required today and into the future.
The successful candidate will also possess a strong understanding of Insider Risk Management and will support the development of targeted awareness, behavioural and educational activities designed to reduce insider-related threats and vulnerabilities.
Key Responsibilities
Awareness, Engagement and Behaviour Change
- Develop and deliver SPENs cyber security awareness strategy and annual delivery plan.
- Design and implement engaging awareness campaigns that drive measurable behavioural improvements.
- Lead the creation of awareness materials, training content, communications, workshops, videos and learning resources.
- Support the delivery of awareness activities to employees, contractors, supply chain partners and third-party organisations.
- Work collaboratively with communications, HR, operational teams and business stakeholders to embed cyber security into everyday decision-making and behaviours.
- Measure the effectiveness of awareness and behaviour change programmes through defined metrics, reporting and outcome-based assessments.
- Identify emerging threats and develop targeted awareness interventions to address specific risks.
Insider Risk Management
- Develop an understanding of insider risk threats within the SPEN operating environment.
- Collaborate with cyber security, HR, legal, physical security and business teams to support Insider Risk Management initiatives.
- Design and deliver awareness activities that educate staff on insider threats, information handling, acceptable use, data protection and secure behaviours.
- Support the development of behavioural indicators, communication campaigns and training materials aimed at reducing insider-related risks.
- Contribute to the continuous improvement of SPENs Insider Risk Management capabilities through awareness, education and engagement.
Skills, Competency and Workforce Development
- Lead the development, implementation and maintenance of cyber security skills and competency frameworks.
- Establish role-based learning pathways aligned to organisational needs and recognised industry frameworks.
- Conduct skills gap assessments and capability reviews to identify development priorities.
- Develop competency models covering both technical and non-technical cyber security roles.
- Create development programmes that support professional growth, career progression and workforce planning.
- Collaborate with HR, Learning & Development and leadership teams to integrate cyber skills development into broader organisational talent strategies.
- Track and report on capability maturity, skills development outcomes and workforce readiness.
Governance and Continuous Improvement
- Maintain awareness of emerging industry trends, threats, learning methodologies and cyber skills frameworks.
- Ensure awareness and training programmes align with SPEN policies, standards and regulatory obligations.
- Support regulatory activities related to cyber culture, workforce capability and organisational resilience.
- Develop performance measures and reporting mechanisms to demonstrate programme effectiveness and return on investment.
- Drive continuous improvement through feedback, lessons learned and performance analytics.
Essential Knowledge and Experience
Experience
- Experience developing and delivering cyber security awareness programmes.
- Experience designing and implementing behaviour change initiatives.
- Experience developing learning and development programmes within a complex organisation.
- Experience creating engaging awareness, training and communications content.
- Experience working with a broad range of stakeholders at all organisational levels.
- Experience developing and implementing workforce skills or competency frameworks.
- Experience conducting capability assessments and skills gap analyses.
- Experience measuring and reporting programme effectiveness using data and metrics.
Knowledge
- Strong understanding of cyber security principles and cyber risk management.
- Good understanding of Insider Risk Management concepts, threats and mitigations.
- Knowledge of behavioural science and behaviour change methodologies.
- Knowledge of cyber culture development and organisational change practices.
- Familiarity with recognised cyber skills frameworks such as:
- SFIA (Skills Framework for the Information Age)
- NIST NICE Cybersecurity Workforce Framework
- UK Cyber Security Council Career Framework
- Relevant industry competency models
Desirable Knowledge and Experience
- Experience within critical national infrastructure, utilities or regulated industries.
- Experience supporting NIS Regulations, CAF, ISO27001 or similar regulatory frameworks.
- Relevant qualifications in cyber security, learning and development, organisational psychology, behavioural science or related disciplines.
- Experience developing insider risk awareness programmes.
- Experience managing external awareness providers, training partners or digital learning platforms.