About this role
This role is responsible for leading Nasstar’s compliance with the Telecoms Security Act (TSA) and associated Ofcom regulatory requirements, ensuring the organisation can evidence a robust and defensible security posture. As a key member of the Risk & Compliance function, this role operates at the intersection of regulation and technology, partnering closely with engineering, security, and operational teams to translate regulatory expectations into practical, real-world control effectiveness. This is a high-impact role with visibility across senior stakeholders and direct relevance to the protection of critical national infrastructure. TSA Compliance & Regulatory Engagement · Lead delivery of Telecoms Security Act compliance activities. Coordinate responses to Ofcom information requests and regulatory submissions. Interpret TSA Code of Practice measures and translate into business and technical actions. Technical Assurance & Evidence Validation Partner closely with Core Engineering, Voice, OSS, Operations, Procurement and IT & Security teams to gather required information. Review and validate technical, architectural, and operational evidence. Provide effective, evidence-based challenge and ensure submissions are complete, accurate, and aligned to regulatory expectations. Risk & Control Assessment Identify gaps in evidence, control weaknesses, and areas requiring remediation. Assess adequacy of compensating controls where full compliance is not achieved. Apply risk scoring in line with Nasstar’s risk management framework. Focus on risks impacting Security Critical Functions and supporting network oversight capabilities. Framework Alignment & Governance Align TSA requirements with broader frameworks such as NCSC CAF, ISO 27001 and HSCN. Support governance reporting and risk committee discussions. Contribute to the development of internal assurance and control frameworks. Third-Party Security & Contractual Oversight Review and advise on supplier contracts to ensure security obligations are appropriate and enforceable. Support Legal & Procurement with security requirements and risk considerations. Contribute to third-party risk and assurance activities.