Information Security Architect

Details

Eneco is establishing its first Security Architecture function within the CISO Office and Digital & Tech domain. The role covers enterprise IT, cloud platforms, applications, operational technology, and supplier ecosystems across critical energy infrastructure. You will define the security blueprint, establish governance and standards, and act as the leading security voice for major programmes and platform initiatives.

Responsibilities

Security Architecture and Governance

• Define and own enterprise security architecture principles, standards, reference architectures, and design patterns across IT, OT, cloud, and application domains.
• Develop solution security architectures for major technology initiatives, platforms, and transformation programmes.
• Establish security architecture review processes and governance forums.
• Review solution designs, implementations, architectural exceptions, and risk-based compensating controls.
• Assess alignment with security policies, standards, risk appetite, NIS2, DORA, GDPR, and applicable regulations.
• Provide clear, risk-based recommendations to senior business and technology stakeholders.

Programmes, Cloud, and Infrastructure

• Act as lead security architect for strategic programmes, platform migrations, and major technology changes.
• Integrate security requirements into procurement, development, implementation, and operational processes.
• Define secure cloud architecture patterns and guidance, primarily for Microsoft Azure, including hybrid and SaaS contexts.
• Lead adoption of zero-trust, identity-centric, and modern security architecture principles.
• Review network, endpoint, infrastructure, and platform solutions against security architecture standards.

Application, Data, and OT Security

• Define secure application architecture requirements, API security standards, and data protection controls.
• Embed security into the software development lifecycle and DevSecOps practices.
• Provide privacy-by-design and data classification requirements.
• Develop and maintain OT security reference architectures for operational technology environments.
• Support the security of industrial control systems and critical infrastructure.
• Assess vendor and solution compliance with OT security requirements, including ISA/IEC 62443 where applicable.
• Ensure security architecture aligns with safety, resilience, and operational availability constraints.

Third-Party Security and Continuous Improvement

• Define security architecture requirements for third-party integrations, managed services, cloud providers, and external connections.
• Support third-party risk management with architectural assessments, technical risk evaluation, and remediation guidance.
• Identify architectural gaps, technical debt, and security improvement opportunities.
• Contribute to multi-year security architecture roadmaps and capability development initiatives.
• Track emerging technologies, threat developments, and industry best practices.

Requirements

• At least 7 years of experience in cybersecurity, information security, security engineering, or security architecture.
• At least 3 years in a dedicated Security Architect, Lead Security Engineer, or Enterprise Security Architect role.
• Experience designing security architectures across complex enterprise IT, OT, cloud, application, and supplier ecosystems.
• Experience supporting major transformation, cloud migration, modernisation, or critical infrastructure programmes.
• Demonstrated ability to influence and challenge senior business and technology stakeholders.
• Expertise in enterprise security architecture, security-by-design, network and infrastructure security, identity and access management, zero-trust architecture, application and API security, secure SDLC, DevSecOps, data security, encryption, privacy-by-design, vulnerability management, security monitoring, cyber resilience, and risk management.
• Cloud security experience, primarily with Microsoft Azure; AWS and hybrid cloud experience is valued.
• OT/ICS security architecture experience; ISA/IEC 62443 is preferred.
• Knowledge of ISO/IEC 27001, ISO/IEC 27002, NIST Cybersecurity Framework, CIS Controls, NIS2, GDPR, ISA/IEC 62443, and DORA where applicable.
• Preferred certifications include CISSP, SABSA, TOGAF, CISM, CCSP, Microsoft Azure security or solutions architecture certifications, GIAC certifications, and ISO 27001 Lead Implementer or Lead Auditor.

Work Environment

The position is based in Eneco's CISO Office within the Digital & Tech domain and works across cloud infrastructure, OT environments, application development, and supplier ecosystems. Eneco's hybrid working model is based in Rotterdam, with approximately 40% office work, 40% home working, and 20% flexible working. With manager approval, employees may work abroad within approved countries for up to three weeks per year, with a maximum of two consecutive weeks.

Benefits

• Gross annual salary of €82,000 to €110,000, including FlexBudget and 8% holiday allowance.
• Depending on the role, a bonus or collective profit sharing.
• FlexBudget can be paid out, exchanged for additional holiday days, or saved.
• Personal and professional development opportunities.
• Flexible working hours and work-from-home options.
• Inclusive work environment and support for workplace adjustments.