Cyber Security Specialist

We're looking for a Cyber Security Specialist to join our Digital Technology function on a permanent basis. This role can be based at Nottingham, Kingswinford or Solihull and offers hybrid working.

Cyber Security Specialist

E.ON is seeking a Cyber Security Specialist to be a driving force within our Cyber Security function, representing information security across the business and acting as a role model for junior colleagues.

You'll own compliance across PCI-DSS, the Smart Energy Code, Retail Energy Code and IT General Controls/Financial IT systems, working with external assessors and auditors to ensure compliance. You'll lead protective monitoring and vulnerability management, covering tooling, log correlation, alerting, dashboards and KPIs. You'll manage cyber security incidents, from daily operational issues to major incidents requiring coordination at UK Board level. You'll provide practical security guidance across Digital Technology and oversee cyber risk assurance of IT suppliers and new business ventures. You'll also mentor junior colleagues, supporting their development and expertise.

This is a hands-on specialist role, requiring the ability to write basic code and queries, alongside confidence managing external stakeholders and regulators.

• Act as a role model and mentor for junior cyber security colleagues, supporting their technical development, confidence and career growth.
• Own E.ON's cyber security compliance obligations: PCI-DSS, Smart Energy Code, Retail Energy Code and ITGC/Financial IT controls — managing external audits and assessor relationships end-to-end.
• Own and improve protective monitoring through integration with E.ON's SOC/CERT and managed service providers.
• Own vulnerability management: tooling, scanning cadence, remediation tracking, KPI reporting and external penetration testing.
• Lead cyber security incident management, coordinating internal teams, service providers and senior stakeholders (up to Board level) and ensuring timely communication.
• Assess and assure the cyber security of new and existing IT suppliers and business acquisitions, including assessments, contract security schedules and ongoing risk-based follow-up.
• Support internal DevSecOps, working alongside Product, Developers, Engineering and Data teams to provide security requirements, perform threat and risk assessments, and review designs and IaC.
• Provide pragmatic, risk-based security guidance across projects and business stakeholders, balancing commercial delivery against security risk.
• Maintain and evolve E.ON's ISMS in line with ISO 27001 principles.
• Oversee enterprise risk assessments and support security governance.
• Lead security projects and manage relationships with auditors, regulators and third-party providers.

What we need from you

• 5+ years' experience in cyber/information security, including mentoring or coaching junior colleagues.
• Proven experience managing ISMS compliance against recognised standards, including ISO 27001/27002 and PCI-DSS.
• Experience building and operating SIEM/protective monitoring capabilities (e.g. Splunk, MS Sentinel), including alerting, dashboards and log analysis.
• Experience with vulnerability management tools (e.g. Qualys, Wiz, GitLab) and penetration testing.
• Proven ability to lead cyber incident response, coordinating internal teams, suppliers and senior stakeholders.
• Experience assessing supplier security, onboarding, contractual requirements and ongoing supply chain risk.
• Hands-on technical capability, including scripting, queries, reviewing Infrastructure as Code (IaC), automated scans and penetration test findings.
• Strong communication skills, translating technical risks into clear business language for all audiences.
• Experience with AWS, Azure or GCP, including containerised and serverless technologies.
• Ability to deputise for the Cyber Security Manager and participate in out-of-hours incident response.

Desirable:

• Experience in energy/utilities, ideally UK smart metering, the Smart Energy Code or similar CNI/NIS-regulated industries.
• Professional security qualification and/or ISO 27001 Lead Implementer/Auditor certification.
• Experience engaging with regulators and managing external audits.
• Knowledge of AI security, including the EU AI Act.
• Exposure to PCI-DSS and IT General Controls/Financial IT audits.
• Experience securing CI/CD environments; GitLab enterprise security experience desirable.
• Experience managing zero-trust and internet filtering solutions (e.g. Zscaler) across diverse devices.
• Experience securing physical and virtual end-user environments, including Citrix, AWS AppStream, Dizzion Frame, Windows, Mac, Android and Chromebooks.
• Experience managing MDM solutions beyond the Microsoft ecosystem, including Google Workspace and Jamf.

Here's what you need to know

• Award-Winning Workplace - We're proud to be named a Sunday Times Best Place to Work 2025 and the Best Place to Work for 16–34-year-olds.
• Outstanding Benefits - Enjoy 26 days' annual leave plus bank holidays, a generous pension, life cover, bonus opportunities and 20 flexible benefits with tax/NI savings.
• Flexible & Family-Friendly - Our hybrid and family-friendly policies earned us double recognition at the Personnel Today Awards 2024. We're open to discussing flexibility.
• Inclusive & Diverse - We're the only energy company in the Inclusive Top 50 UK Employers, and proud winners of Best Employer for Women and Human Company of the Year.
• Support at Every Stage of Life - We're Fertility Friendly and Menopause Friendly accredited, with inclusive support for everyone.
• Accessible & Supportive - As a Disability Confident Employer, we ensure disabled applicants meeting the minimum criteria progress to the next recruitment stage, with adjustments available throughout.
• Invested in Your Growth - From inclusive talent networks to development programmes, we'll support your growth every step of the way.