E.ON is looking for a Cyber Security Specialist to be a driving force within our Cyber Security function, acting as the face of information security for the whole business and a role model for junior members of the team.

You'll own E.ON’s compliance across PCI-DSS, the Smart Energy Code, the Retail Energy Code, and IT General Controls/Financial IT systems controls- working alongside and steering external assessors and auditors to keep us operating without restriction.

You'll lead on protective monitoring and vulnerability management capabilities- from tooling and log correlation through to alerting, dashboards and KPIs and lead the response to cyber security incidents of every scale, from daily operational issues to potentially major incidents requiring coordination up to UK Board level.

Beyond the technical delivery, you'll provide pragmatic security guidance and coaching across Digital Technology, support the onboarding and ongoing assurance of IT suppliers and new business ventures from a cyber risk perspective. You'll act as a role model within the team, mentoring and supporting the growth and development of junior colleagues as they build their own expertise.

This is a hands-on specialist role: you'll need to be comfortable writing basic code and queries yourself where needed, as well as managing external stakeholders and regulators.

• Act as a role model and mentor for junior members of the cyber security team, supporting their technical development, confidence and career growth.
• Own E.ON's cyber security compliance obligations: PCI-DSS, Smart Energy Code, Retail Energy Code, and ITGC/Financial IT controls — managing external audits and assessor relationships end-to-end.
• Own and continuously improve protective monitoring through integration with E.ON's SOC/CERT and managed service providers.
<li style="line-height: 137%; border-width: medium; border-color: currentcolor; margin: 0.0cm 0

Main Responsibilities

• Liaise with managers to gather, obtain MD sign off for and feed to UK and Digitl Technology all input for quarterly risk reporting efficiently and to timetable. Ensuring mitigating actions are formally identified, documented and tracked.
• Responsible for organising any necessary testing of internal controls incl. security audit and obtaining formal sign offs in liaison with appropriate stakeholders
• Responsible for liaising with auditors and arranging contact with appropriate internal or outsourcer contacts to enable necessary testing to be carried out.
• Responsible for ensuring any follow up actions are carried out to the required standard and deadline
• Liaise with Group/ Digital Technolody /Suppliers /UK teams on a regular basis ensuring all security standards are adhered to

• Early engagement support to projects ensuring security is built in by design
• Attendance at relevant PMO review board for projects, ensuring that appropriate security artefacts have been completed and accepted.
• Deliver security architecture advice to projects to ensure that security controls and requirements are architected into the technical solution
• Supplier management information security compliance – onboarding, audit and ongoing reviews.
• Performing threat and risk assessments to ISO27005 standards, producing consolidated risks and assigning risk custodians to relevant suppliers (IS1 knowledge advantageous)
• Scoping and managing CHECK based penetration tests
• Ensuring remediation plan is created and action owners assigned
• You assure that public and private Cloud Services are delivered securely i

• Significant experience (5+ years) in a cyber/information security role, with a track record of mentoring or coaching junior colleagues.
• Demonstrable experience managing security compliance against recognised frameworks (e.g. ISO 27001/27002, PCI-DSS) within an operating ISMS.
• Experience designing, building and operating protective monitoring/SIEM capability (e.g. Splunk, MS Sentinel or equivalent), including alerting, dashboards and log correlation/investigation.
• Experience of vulnerability management tooling and process (e.g. Qualys, Wiz, Gitlab or equivalent), and of scoping and interpreting external penetration tests for a business audience.
• Proven track record leading cyber security incident response, including coordinating across internal teams, suppliers and senior/Board-level stakeholders.
• Experience assessing and assuring third-party/supplier cyber security, including supplier on-boarding, contract security requirements and ongoing supply chain risk management.
• Comfortable working hands-on technically (e.g. writing scripts/queries for monitoring or data processing) as well as reviewing IaC and automated code scans/pen test outputs to assess technical risk and compliance to standards.
• Excellent written and verbal communication skills, with the ability to translate technical risk into business language for varied audiences, up to senior leadership.
• <span style="font-family: arial, helvetica,