Information Security Architect

Eneco is one of Europe’s leading sustainable energy companies, committed to climate neutrality by 2035 through our One Planet strategy. We are electrifying heating, mobility, and industry at scale — and the technology that supports that ambition is growing at the same pace as the ambition itself.

Security architecture at Eneco is not a compliance checkbox. It sits at the intersection of a major IT and OT transformation, the protection of critical national infrastructure, and a regulatory environment — NIS2, DORA, GDPR — that is only becoming more demanding. The decisions made here are consequential in a way that most security roles are not: energy infrastructure, smart grid technology, OT environments, cloud platforms, and real-time trading systems.

And unlike most organisations of this scale, Eneco does not yet have a Security Architect or an enterprise architecture function. You are not joining an established practice — you are founding one.

As Senior Security Architect, you combine deep technical expertise with architectural authority and business influence. You define the security blueprint across IT, OT, cloud, applications, and supplier ecosystems — and you make sure it is actually adopted. You own the standards, run the reviews, and act as the lead security voice in every major programme and platform initiative.

You drive security-by-design across the organisation, from cloud platform patterns to Dev Sec Ops  practices, from OT reference architectures to third-party integration requirements. You identify the gaps between where Eneco is today and where the security architecture needs to be, and you translate that into a roadmap the organisation can execute.

• Define and own enterprise security architecture principles, standards, reference architectures, and design patterns across IT, OT, cloud, and application domains
• Develop solution security architectures for major technology initiatives, platforms, and transformation programmes
• Embed secure-by-design and secure-by-default principles into every layer of the technology estate
• Maintain a current target-state security architecture aligned to business strategy and regulatory requirements

• Establish and operate security architecture review processes and governance forums
• Review solution designs, technology implementations, and architectural exceptions — including risk-based compensating controls
• Assess alignment with security policies, standards, risk appetite, NIS2, DORA, GDPR, and applicable regulation
• Provide clear, risk-based recommendations that senior business and technology stakeholders can act on

• Act as lead security architect for strategic programmes, platform migrations, and major technology changes
• Conduct architecture and design reviews at every stage of the project lifecycle
• Integrate security requirements into procurement, development, implementation, and operational processes
• Validate that controls are appropriately designed, implemented, and effective

• Define secure cloud architecture patterns and implementation guidance — primarily Azure, including hybrid and SaaS contexts
• Lead adoption of zero-trust, identity-centric, and modern security architecture principles
• Develop reusable security standards for infrastructure and platform engineering teams
• Review network, endpoint, and infrastructure solutions against security architecture standards

• Define secure application architecture requirements, API security standards, and data protection controls
• Embed security within the software development lifecycle and Dev Sec Ops  practices
• Provide privacy-by-design and data classification requirements across…