As Cyber Attack Surface Management (CASM) Lead, you shape a central security capability that protects the vital infrastructure of the Netherlands. Enexis is at the heart of the energy transition. Our landscape – from IT to OT – is becoming more complex and more critical. You make sure we always know where we are vulnerable, which risks are most urgent, and who needs to act to reduce them.
- You make direct impact on the energy transition by making our IT and OT environment demonstrably more secure.
- You build and lead a multidisciplinary team of IT and OT specialists within the Digital Resilience Center.
- You can count on solid employment conditions such as a strong pension, a generous personal budget and a €700 vitality budget.
As CASM Lead, you are the “player‑coach” of a new central team that maps, monitors and helps reduce Enexis’s attack surface. You define the CASM vision, set up processes and tooling, and build a data‑driven capability that brings our IT and OT landscapes together. You establish a central analytics environment, ensure asset discovery and integration with the CMDB, and make sure vulnerabilities flow into a uniform triage process. You work closely with SOC teams, security architects and system owners, so that CASM is not an island but a core part of our digital resilience.
Your responsibilities
- Develop and continuously refine the CASM strategy, vision, processes and multi‑year roadmap.
- Lead a virtual, multidisciplinary team of IT and OT CASM analysts, including coaching and team development.
- Set up asset discovery (cloud, network, endpoints, IT‑for‑OT, OT) and integration with CMDB and scanners.
- Build a central data/analytics platform for scanner data, KPIs, reporting and risk models.
- Translate technical vulnerabilities into concrete business risks and drive risk‑based prioritisation.
- Enable OT‑safe discovery and scanning and embed OT‑specific hardening and configuration controls.
- Together with other teams, define scope and requirements for specialist testing such as penetration tests and red teaming.
