Cyber Security Process Specialist

Position Description

As a key member of the Generation Cybersecurity Team, this role supports the Generation Cybersecurity Manager in safeguarding Generation from cybersecurity threats and ensuring compliance with regulatory requirements, such as the NIS Directive. The role involves collaborating with the OT Cybersecurity Team (EMP) and local experts to develop and implement security measures and procedures that align with ESB's cybersecurity policies and external regulations. Additionally, the role promotes awareness of strategic initiatives and encourages the adoption of self-sustaining security practices within Generation teams.

Key Responsibilities 

• Lead and coordinate strategic and operational cybersecurity activities across Generation and Trading, ensuring alignment with business objectives and regulatory requirements.
• Operationalise cybersecurity risk management procedures, embedding robust controls and monitoring frameworks to support informed decision-making and resilience.
• Support the development, implementation, and maintenance of cybersecurity procedures and baselines in collaboration with the relevant teams.
• Conduct and lead comprehensive compliance assessments and audits of OT systems, security procedures, and baseline against applicable regulations, laws, policies, and standards.
• Perform cybersecurity risk assessments and vulnerability assessments of OT systems and networks.
• Stay up to date on emerging threats, vulnerabilities, and technologies in OT cybersecurity and recommend proactive measures to mitigate risks.
• Collaborate with IT, OT, and EMP teams to integrate cybersecurity measures into the design, implementation, and governance of new systems and technologies.
• Participate in incident response activities, including investigation, containment, recovery, and communication of cybersecurity incidents.
• Prepare documentation for audits and compliance with Corporate and/or NIS Directive requirements, support interactions with internal audit and external regulators.
• Work closely with vendors on reviews, vulnerability assessments, mitigations, and implementation of cybersecurity-related activities.
• Develop and manage asset inventory.
• Engage with business units to measure KPIs, support corrective action plans, and drive continuous improvement in cybersecurity practices.

Experience and Qualifications

 Essential

• 5+ years of relevant working experience in the generation sector or a comparable industry with OT Cybersecurity experience.
• 3rd-level qualification or equivalent in engineering or equivalent with experience in OT and C&I technologies, projects, and practices.
• Experience in Risk Management and/or Governance & Compliance roles.
• Experience in cybersecurity roles, with specific expertise in OT/ICS security.
• Familiarity with cybersecurity frameworks such as the ISO 27001, NIST Cybersecurity Framework, and IEC/ISA 62443.
• Demonstrated internal and external stakeholder management and project/scope coordination involving multiple stakeholders, contractors or third parties.
• Self-motivated individuals with the drive to professionally develop self and others and share knowledge and competencies within a team structure.
•  Analytical and problem-solving skills, with the ability to assess complex systems and identify security risks.
• Ability to work independently and in a team environment to pinpoint root causes and devise solutions with minimal oversight.
• Full clean driving license and flexibility to travel nationally and internationally.

Desirable

• Knowledge of industrial control systems, SCADA systems, DCS systems, IPS systems, PLC, and other OT technologies and communication protocols
• An Engineering or Cybersecurity background with experience working in an OT discipline.
• Experience in cybersecurity policies, standards, and procedures gained from working within an Operational Technology environment.
• Knowledge of DCS, SIS, PLC, SCADA, and NMS Operational Technologies.
• Knowledge of control systems communication protocols.
• An understanding of security frameworks, e.g., NIS Directive, ISA 62443, and Purdue Enterprise Reference Architecture.
• Understanding of network architecture and topologies.
• Familiarity with threat intelligence, vulnerability assessment, Identity management, and incident response. Ability to proactively research and maintain knowledge of the cyber threat landscape.

Location

This position will be based in F27, with occasional travel to ESB generation assets as required.

ESB is committed to smart working – combining digital tools with a culture of trust and empowerment to enable flexible ways of working. The successful candidate may work flexibly within their jurisdiction with attendance at the workplace for in-person collaboration on at least one anchor day per week. All smart working arrangements are subject to manager approval and ongoing review, based on the operational requirements of the role, the team, and the individual. 

Reporting To

Cyber Security Manager, Asset Management, Generation and Trading