Cyber Security Specialist

Salary- £72,277 - £86,060

  Location- Nottingham, Kingswinford or Solihull with hybrid working. 

E.ON is looking for a Cyber Security Specialist to be a driving force within our Cyber Security function, acting as the face of information security for the whole business and a role model for junior members of the team.

You'll own E.ON's compliance across PCI-DSS, the Smart Energy Code, the Retail Energy Code, and IT General Controls/Financial IT systems controls- working alongside and steering external assessors and auditors to keep us operating without restriction.

You'll lead on protective monitoring and vulnerability management capabilities- from tooling and log correlation through to alerting, dashboards and KPIs and lead the response to cyber security incidents of every scale, from daily operational issues to potentially major incidents requiring coordination up to UK Board level.

Beyond the technical delivery, you'll provide pragmatic security guidance and coaching across Digital Technology, support the onboarding and ongoing assurance of IT suppliers and new business ventures from a cyber risk perspective. You'll act as a role model within the team, mentoring and supporting the growth and development of junior colleagues as they build their own expertise.

This is a hands-on specialist role: you'll need to be comfortable writing basic code and queries yourself where needed, as well as managing external stakeholders and regulators.

• Act as a role model and mentor for junior members of the cyber security team, supporting their technical development, confidence and career growth.
• Own E.ON's cyber security compliance obligations: PCI-DSS, Smart Energy Code, Retail Energy Code, and ITGC/Financial IT controls - managing external audits and assessor relationships end-to-end.
• Own and continuously improve protective monitoring through integration with E.ON's SOC/CERT and managed service providers.
• Own vulnerability management: tooling, scanning cadence, remediation tracking, KPI reporting, and scoping/delivery of external penetration tests.
• Lead the management of cyber security incidents of all types and scales, coordinating internal teams, service providers and senior stakeholders (up to Board level) and ensuring timely, accurate communication throughout.
• Assess and assure the cyber security posture of new and existing IT suppliers and business acquisitions, including assessments, contract security schedules and ongoing risk-based follow-up.
• Support internal DevSecOps ways of working. Working alongside, Product, Developers, Engineering and Data functions to provide security requirements, perform threat and risk assessments, review designs and IaC.
• Provide pragmatic, risk-based security consultancy and guidance to multiple projects and business stakeholders simultaneously, balancing commercial delivery against security risk.
• Maintain and evolve E.ON's ISMS in accordance with 27001 principles.
• Oversee enterprise risk assessments and support security governance.  
• Lead security projects and manage relationships with auditors, regulators, and third-party providers. 

• Significant experience (5+ years) in a cyber/information security role, with a track record of mentoring or coaching junior colleagues.
• Demonstrable experience managing security compliance against recognised frameworks (e.g. ISO 27001/27002, PCI-DSS) within an operating ISMS.
• Experience designing, building and operating protective monitoring/SIEM capability (e.g. Splunk, MS Sentinel or equivalent), including alerting, dashboards and log correlation/investigation.
• Experience of vulnerability management tooling and process (e.g. Qualys, Wiz, Gitlab or equivalent), and of scoping and interpreting external penetration tests for a business audience.
• Proven track record leading cyber security incident response, including coordinating across internal teams, suppliers and senior/Board-level stakeholders.
• Experience assessing and assuring third-party/supplier cyber security, including supplier on-boarding, contract security requirements and ongoing supply chain risk management.
• Comfortable working hands-on technically (e.g. writing scripts/queries for monitoring or data processing) as well as reviewing IaC and automated code scans/pen test outputs to assess technical risk and compliance to standards.
• Excellent written and verbal communication skills, with the ability to translate technical risk into business language for varied audiences, up to senior leadership.
• Experience of working within at least one cloud environment (AWS/Azure/GCP) and of modern containerised and serverless technologies.
• The role holder will be expected to deputise for the Cyber Security Manager and form part of out of hours cyber security incident response.

Desirable: 

• Experience within the energy/utilities sector, particularly UK smart metering and the Smart Energy Code or similar CNI/NIS industry.
• A professional security qualification (e.g. CISSP, CISM, CRISC) and/or ISO 27001 Lead Implementer/Auditor certification.
• Experience representing an organisation externally to regulators and of being audited by external parties.
• Familiarity with AI security topics, including the EU AI Act.
• Exposure to PCI-DSS and IT General Controls/Financial IT systems control audits.
• Experience of security within a CICD environment. Exposure to Gitlab and its enterprise security features a bonus.
• Experience of operating zero-trust and internet access filtering solutions (i.e. ZScaler) across a diverse end-user device base.
• Experience of securing physical and virtual end-user devices such as Dizzion Frame, Citrix, AWS AppStream or similar. Along with a variety of physical end-user devices including Chromebooks, Windows, Android and Mac.
• Experience of operating MDM solutions outside a traditional Microsoft stack such as Google Workspace, Jamf etc.

Please note the closing date may end early if we receive a high volume of applications, please apply at your earliest opportunity.