Entity:

Technology

Job Family Group:

IT&S Group

Job Description:

As the Information Security Principal for Upstream, we will look to you to provide cyber security leadership across our global Upstream business. You'll be part of our extended Upstream Digital leadership team and the Digital Security discipline. You'll lead a geographically distributed team across the UK, US and Kuala Lumpur, bringing people together around common goals and helping them thrive in their careers. Technology is redefining how we operate, from AI and autonomous operations to increasingly connected industrial environments. How do we unlock these opportunities while keeping our people, operations and data safe and secure? That's where this role comes in. We believe security should enable the business—not stand in its way.

You will be accountable for delivering Information Security management across Upstream, ensuring cyber risk is understood, owned and led at the pace the business needs:

• Business outcomes: Collaborate with the Upstream business leadership to identify and address cyber security risks.
• Security Expertise: Provide technical expertise in Information Security, implementing operating processes and ensuring alignment to security policies and standards.
• Team Leadership: Lead, mentor, and develop a resilient team across geographies, aligning with our vision and strategy, encouraging continuous improvement and career progression.
• Relationship Management: Act as main point of contact for information security for bp Upstream, building strong partnerships and influencing positive change.
• Incident Management: Collaborate on incident response efforts.
• Safety: Prioritize operational safety.

Education:

• Tertiary-level qualification or equivalent work experience.
• Degree or equivalent experience in Information Security or Computer Science Engineering
• Relevant certifications such as CISSP, CISM, or CISA are desirable.

Experience:

• Significant experience in internal or external information security roles.
• Solid grasp of cyber security frameworks, standards, and good practices.
• Demonstrable experience working in large enterprise environment.
• Ability to form effective partnerships with the business and senior management.
• Experience in oil and gas or energy sector (desired).

Technical Capability

• Proven grounding in cyber risk, threat modelling, secure-by-design and control effectiveness measurement.
• Technical knowledge in delivering security solutions and leading security processes.
• Experience of engaging with regulators and government bodies (e.g., NCSC, CISA).
• Knowledge of Operational Technology security (ICS/SCADA, DCS, OT network segmentation) is desirable.

Leadership and EQ:

• Build, lead and encourage high-performing global teams and peers, upholding bp's code of conduct and values.
• Stay up-to-date with the latest cyber security trends, threats, and technologies.
• Ability to operate in ambiguity, shifting priorities, and rapid decision-making.
• Excellent executive communication and influencing skills.

Business Capability:

• Act as change agent for the front line and senior leadership.
• Track record of influencing business outcome based on cyber risk.
• Ability to translate technical cyber risk into commercial, safety, and regulatory language.
• Comfortable operating in matrixed, multi-cultural, multi-time-zone environments.

Why join us?

We’re committed to supporting leaders who want to make an impact. At bp, you’ll have the chance to shape and influence outcomes across businesses. You’ll be part of an inclusive environment where diverse perspectives are valued, and where your contribution to performance and integration matters. We invest in the growth and wellbeing of our people, providing the resources, networks, and development opportunities needed to thrive.

Our total rewards package includes competitive pay, bonuses, share options, and a range of flexible benefits designed to meet your needs — from healthcare and retirement plans to paid time off and agile working. We recognise that people have multifaceted lives, and we strive to offer a career experience that reflects that.

Location

Please note that while the position can be based in our Sunbury office, this will move to Southwark, London by end 2027.

Apply now!

Travel Requirement

Negligible travel should be expected with this role

Relocation Assistance:

This role is not eligible for relocation

Remote Type:

This position is a hybrid of office/remote working

Skills:

Consulting, incident investigation and response, Incident Management, Information Assurance, Information Security, Information security behaviour change, Risk Management, Stakeholder Management, Supplier Relationship Management, Supplier security management

Legal Disclaimer:

We are an equal opportunity employer. We do not discriminate on the basis of protected characteristics like race, religion, color, sex, national origin, sexual orientation, veteran status or disability status. Individuals with an accessibility need may request an adjustment/accommodation related to bp’s recruiting process (e.g., accessing the job application, completing required assessments, participating in telephone screenings or interviews, etc.). If you would like to request an adjustment/accommodation related to the recruitment process, please contact us.

If you are selected for a position and depending upon your role, your employment may be contingent upon adherence to local policy. This may include pre-placement drug screening, medical review of physical fitness for the role, and background checks.