IT Security Analyst

About the company

E.ON in Sweden is part of the international energy group E.ON SE with headquarters in Essen, Germany. Within the group, around 70,000 people work in 17 countries. Around Sweden, around 2,100 dedicated employees work. Our Nordic headquarters is located in Malmö. In Sweden, we deliver electricity, heating, and smart energy solutions to over a million households and businesses. E.ON's role is to take responsibility for and drive development forward, so that more people can make the transition. With our investments and our customers' willingness to contribute, we work to continue electrifying society and meet future energy needs.

We at CERT Nordic work to protect E.ON's critical societal energy supplies. We are IT security analysts who together monitor and protect E.ON's industrial control systems within the power grid and district heating in Sweden, Denmark, and the United Kingdom. Our mission is to detect and manage cyber threats that could affect E.ON's ability to deliver electricity and heat to society. This means our work has a direct connection to the safety, stability, and security of millions of people.

What is it like with us? With us, you will become part of an experienced and warm team where collaboration, knowledge sharing, and a clear common goal are central: to protect critical societal infrastructure. The team consists of 6 colleagues who work closely together in a secure and non-hierarchical environment, where there is high trust, great individual responsibility, and a strong will to help each other. You will also have international contact surfaces and collaborate with colleagues from different parts of the E.ON group. Your immediate manager Oskar is characterized by being clear, empathetic, and supportive, with a working method where the team's perspectives and needs are taken into account and where decisions are made jointly. This creates an environment where you get freedom under responsibility and good conditions to succeed in your role.

At E.ON, we actively work with inclusion - it is crucial to drive the energy transition forward. We want you specifically to feel welcome! We strive to create a safe working environment with meaningful tasks and good opportunities for development. We constantly challenge ourselves to create a welcoming workplace, where we hope you will thrive. We work for a more sustainable energy society, but it is at least as important that our employees have the conditions to care for their own sustainability. We therefore offer good benefits so that you can feel well and have a good balance between work and leisure. Some of these include, for example, reduced working hours that are higher than the industry standard, health insurance, free healthcare, and more!

Your tasks

Your role As an IT Security Analyst in CERT-NO, you will have a broad and technically varied role. You will work both as a security analyst and with the operational management of the team's security solutions.

Your main tasks

• Monitor and analyze the security situation in E.ON's OT environments, focusing on detecting potential cyber threats and anomalies.
• Identify, investigate, and prioritize security incidents through continuous log and event analysis as well as the use of relevant security tools.
• Participate in incident management and coordinate response work, including participation in regular incident exercises and improvement activities.
• Install, configure, patch, troubleshoot, and maintain the team's security solutions and associated technical components.
• Support the business in security-related issues, such as:

Participate in threat modeling and assess relevant attack vectors

Work with compliance and policy-driven tasks, including follow-up and improvement of security routines

Requirements

Your experience We are looking for you who have a technical foundation, good analytical ability, and a genuine interest in IT security and industrial control systems. You thrive in a trust-based working method that is built on commitment, self-leadership, and close collaboration with your team.

We would like you to have

• Post-secondary education in cybersecurity or equivalent
• Experience working in SIEM platforms and a good ability to perform log and event analysis.
• Practical experience with, for example, EDR, IDS, vulnerability scanning, or log management.
• Experience in installation, configuration, patching, upgrading, troubleshooting, or ongoing system management.
• Good knowledge of Windows and Linux as well as an understanding of networks, routing, and firewalls
• Ability to document technical solutions and communicate with both technical and business-oriented stakeholders.
• Ability to communicate in English in an international environment

Meritorious

• Practical experience in incident management, including participating in analyses, root cause investigations, and recovery work
• Experience with automation using, for example, PowerShell, Python, or APIs.
• Experience with integrations between security platforms, data sources, and central consoles.
• Work with industrial control systems (ICS) such as SCADA, PLC, RTU, HMI, and associated industrial communication protocols (e.g., Modbus/TCP, IEC 61850, Profinet)
• Experience from OT environments or the energy sector, especially where availability and secure operation are critical components of the business

How to apply

A warm welcome to apply and join us on the way towards a more sustainable society! The last application date is November 2nd.

For questions about the position, please contact the recruiting manager Oskar Edvinsson, Oskar.Edvinsson@eon.se

For union questions, please contact Hanna Rosen, Unionen, +46 705 705254 Akademikerna, Akademikerna@eon.se Mattias Andolfsson, Ledarna, mattias.andolfsson@eon.se

Other

The position is located in Sweden and involves that you regularly participate in collaborations, exercises, and development initiatives together with international colleagues. Travel is included in the position, primarily in connection with team meetings, installations, exercises, and joint activities across borders.

Since we work with critical societal operations, the employment is security-cleared, which means that a security clearance will be conducted before employment.