Cyber Security Specialist E.ON UK Ltd

The Cyber Security Specialist will manage the IT risks and controls in E.ON UK, including the security compliance, certification and accreditation of Suppliers The role holder will work in a complex multi- supplier environment to deliver a robust set of controls which manage the IT risks and security requirements of E.ON UK. The role holder will ensure all control and risk owners are clear and that the controls and risks are kept up to date and reviewed on a regular frequency. They will be a champion of Security and Risk management, providing guidance and coaching for all units in Digital Technology UK They will work in co-operation with a number of other functional units in E.ON UK including: Information Security, Internal Controls, Audit services, SMART assurance and the Responsible owners in each of the major IT Suppliers to achieve end to end continuity of control. The role holder will maintain a record of all the risks and controls which remain in the accountability of IT, regardless of outsourcing.

Main Responsibilities

• Liaise with managers to gather, obtain MD sign off for and feed to UK and Digitl Technology all input for quarterly risk reporting efficiently and to timetable. Ensuring mitigating actions are formally identified, documented and tracked.
• Responsible for organising any necessary testing of internal controls incl. security audit and obtaining formal sign offs in liaison with appropriate stakeholders
• Responsible for liaising with auditors and arranging contact with appropriate internal or outsourcer contacts to enable necessary testing to be carried out.
• Responsible for ensuring any follow up actions are carried out to the required standard and deadline
• Liaise with Group/ Digital Technolody /Suppliers /UK teams on a regular basis ensuring all security standards are adhered to

• Early engagement support to projects ensuring security is built in by design
• Attendance at relevant PMO review board for projects, ensuring that appropriate security artefacts have been completed and accepted.
• Deliver security architecture advice to projects to ensure that security controls and requirements are architected into the technical solution
• Supplier management information security compliance – onboarding, audit and ongoing reviews.
• Performing threat and risk assessments to ISO27005 standards, producing consolidated risks and assigning risk custodians to relevant suppliers (IS1 knowledge advantageous)
• Scoping and managing CHECK based penetration tests
• Ensuring remediation plan is created and action owners assigned
• You assure that public and private Cloud Services are delivered securely i

• Significant experience (5+ years) in a cyber/information security role, with a track record of mentoring or coaching junior colleagues.
• Demonstrable experience managing security compliance against recognised frameworks (e.g. ISO 27001/27002, PCI-DSS) within an operating ISMS.
• Experience designing, building and operating protective monitoring/SIEM capability (e.g. Splunk, MS Sentinel or equivalent), including alerting, dashboards and log correlation/investigation.
• Experience of vulnerability management tooling and process (e.g. Qualys, Wiz, Gitlab or equivalent), and of scoping and interpreting external penetration tests for a business audience.
• Proven track record leading cyber security incident response, including coordinating across internal teams, suppliers and senior/Board-level stakeholders.
• Experience assessing and assuring third-party/supplier cyber security, including supplier on-boarding, contract security requirements and ongoing supply chain risk management.
• Comfortable working hands-on technically (e.g. writing scripts/queries for monitoring or data processing) as well as reviewing IaC and automated code scans/pen test outputs to assess technical risk and compliance to standards.
• Excellent written and verbal communication skills, with the ability to translate technical risk into business language for varied audiences, up to senior leadership.