Cyber Security Architect in Rotterdam

Eneco is one of Europe's leading sustainable energy companies, committed to climate neutrality by 2035 through our One Planet strategy. We are electrifying heating, mobility, and industry at scale - and the technology that supports that ambition is growing at the same pace as the ambition itself.

Security architecture at Eneco is not a compliance checkbox. It sits at the intersection of a major IT and OT transformation, the protection of critical national infrastructure, and a regulatory environment - NIS2, DORA, GDPR - that is only becoming more demanding. The decisions made here are consequential in a way that most security roles are not: energy infrastructure, smart grid technology, OT environments, cloud platforms, and real-time trading systems. And unlike most organisations of this scale, Eneco does not yet have a Security Architect or an enterprise architecture function. You are not joining an established practice - you are founding one.

As Senior Security Architect, you combine deep technical expertise with architectural authority and business influence. You define the security blueprint across IT, OT, cloud, applications, and supplier ecosystems - and you make sure it is actually adopted. You own the standards, run the reviews, and act as the lead security voice in every major programme and platform initiative.

You drive security-by-design across the organisation, from cloud platform patterns to DevSecOps practices, from OT reference architectures to third-party integration requirements. You identify the gaps between where Eneco is today and where the security architecture needs to be, and you translate that into a roadmap the organisation can execute.

Security Architecture & Design

Define and own enterprise security architecture principles, standards, reference architectures, and design patterns across IT, OT, cloud, and application domains

Develop solution security architectures for major technology initiatives, platforms, and transformation programmes

Embed secure-by-design and secure-by-default principles into every layer of the technology estate

Maintain a current target-state security architecture aligned to business strategy and regulatory requirements

Governance & Assurance

Establish and operate security architecture review processes and governance forums

Review solution designs, technology implementations, and architectural exceptions - including risk-based compensating controls

Assess alignment with security policies, standards, risk appetite, NIS2, DORA, GDPR, and applicable regulation

Provide clear, risk-based recommendations that senior business and technology stakeholders can act on

Programmes, Projects & Change

Act as lead security architect for strategic programmes, platform migrations, and major technology changes

Conduct architecture and design reviews at every stage of the project lifecycle

Integrate security requirements into procurement, development, implementation, and operational processes

Validate that controls are appropriately designed, implemented, and effective

Cloud & Infrastructure Security

Define secure cloud architecture patterns and implementation guidance - primarily Azure, including hybrid and SaaS contexts

Lead adoption of zero-trust, identity-centric, and modern security architecture principles

Develop reusable security standards for infrastructure and platform engineering teams

Review network, endpoint, and infrastructure solutions against security architecture standards

Application & Data Security

Define secure application architecture requirements, API security standards, and data protection controls

Embed security within the software development lifecycle and DevSecOps practices

Provide privacy-by-design and data classification requirements across technology programmes

Review application and integration designs for security risks and architectural alignment

OT / IC S Security Architecture

Develop and maintain OT security reference architectures for Eneco's operational technology environments

Support engineering teams in securing industrial control systems and critical infrastructure

Assess vendor and solution compliance with OT security requirements, including ISA/IEC 62443 where applicable

Ensure security architecture requirements align with safety, resilience, and operational availability constraints

Third-Party & Supply Chain Security

Define security architecture requirements for third-party integrations, managed services, cloud providers, and external connections

Support the TPRM team with architectural assessments, technical risk evaluation, and remediation guidance

Review architectures associated with suppliers and strategic partners

Roadmap & Continuous Improvement

Identify architectural gaps, technical debt, and security improvement opportunities across the estate

Contribute to multi-year security architecture roadmaps and capability development initiatives

Track emerging technologies, threat developments, and industry best practice

Provide thought leadership on future-state security architecture, resilience, and control maturity

You are a builder, not an inheritor. You have set up security architecture functions before - or you have operated in environments where you had to create the structure yourself because no one else was going to. You know how to establish a governance process from zero, write the first reference architecture before anyone asks for it, and earn credibility with engineering teams who have never had a security architect in the room before.

You are equally at home on the IT and OT side of the line. You understand the difference between a cloud platform decision and an industrial control system risk, and you know how to communicate both to a CISO, a platform engineer, and an operations team in the same week. You balance technical rigour with business pragmatism - you know when to hold the line on a standard and when a compensating control is the right call. You do not need a framework handed to you. You build the framework.

Required experience

Minimum 7 years in cybersecurity, information security, security engineering, or security architecture

Minimum 3 years in a dedicated Security Architect, Lead Security Engineer, or Enterprise Security Architect role

Experience designing security architectures across complex enterprise environments - IT, OT, cloud, application, and supplier ecosystems

Experience supporting major transformation, cloud migration, modernisation, or critical infrastructure programmes

Demonstrated ability to influence and challenge senior business and technology stakeholders

Technical knowledge

Enterprise security architecture and security-by-design

Cloud security - primarily Microsoft Azure; AWS and hybrid cloud experience valued

Network, endpoint, infrastructure, and platform security

Identity and access management and zero-trust architecture

Application security, API security, secure SDLC, and DevSecOps

Data security, classification, encryption, and privacy-by-design

OT / IC S security architecture - ISA/IEC 62443 preferred

Third-party and supply chain security

Vulnerability management, security monitoring, and detection

Business continuity, cyber resilience, and risk management

Frameworks & regulatory knowledge

ISO/IEC 27001 and ISO/IEC 27002

NIST Cybersecurity Framework

CIS Controls

NIS2 and applicable national cybersecurity legislation

GDPR

ISA/IEC 62443 (preferred)

DORA (where applicable)

Preferred certifications

CISSP

SABSA

TOGAF

CISM

CCSP

Microsoft Azure security or solutions architecture certifications

GIAC security certifications

ISO 27001 Lead Implementer or Lead Auditor

You join Eneco's CISO Office within the Digital & Tech domain, embedded in the Security Architecture & Engineering team. You work across the full technology estate - cloud infrastructure, OT environments, application development, and supplier ecosystems - as the architectural authority on security.

The role connects you directly with enterprise architects, engineering leads, programme managers, and senior business stakeholders. You will operate at both strategic and technical levels: defining the target-state architecture, running the governance forums, and getting into the design detail when it matters. Eneco's hybrid working model is based in Rotterdam, with the flexibility to work where you deliver the most impact.

This is a senior individual contributor role with real influence. You are the expert in the room - and you will be expected to act like it.

The timing is the opportunity. Eneco is mid-transformation: cloud modernisation is running, OT environments are expanding, major platform decisions are being made right now. None of those decisions currently have a security architecture voice in the room. You arrive at exactly the moment when what you define will actually become the standard - because the patterns are not set yet. In two years, this will be an established function. Right now, it is a blank page.

You are the first. There is no Security Architect at Eneco. The function does not exist yet - and neither does an enterprise architecture layer above it. You are not inheriting a framework, a governance model, or a set of standards. You are building all of it from scratch, at a company that operates critical energy infrastructure across IT and OT, with NIS2, DORA, and an accelerating cloud and digital transformation already in motion. That combination - full mandate, no ceiling, genuinely consequential scope - is rare at any organisation of this scale.

IT and OT - both, at real scale. Most security architect roles sit firmly on one side of that line. This one crosses it. Eneco's estate covers enterprise IT, cloud platforms, and operational technology in critical energy infrastructure - and the security architecture needs to work across all of it. If you have spent your career wanting to work at the intersection of digital transformation and OT security, without the compromise of doing only one half, this is that role.

#J-18808-Ljbffr