Security & Risk Officer

You will own security and operational risk at Eddy Grid: you understand the technology, translate legislation and regulation into practice, set the framework and make sure it works. Our engineers build and run the systems; you define what those systems must meet and oversee that they do.

The scope is broad: physical building access, IT and devices, our codebase and deployments, certificates, connectors to AI tools (MCP) and access to the energy markets we trade on.

The role deliberately sits apart from the CTO. You report to the CFO and have independent access to all systems.

Depending on how the role and the company develop, other compliance-related work may also fall under your responsibility.

What you'll do

• Set up a security and risk framework, and own its documentation and monitoring.

• Design access management: who can reach which data and systems, who can commit and deploy code, and how we enforce that with a four-eyes principle.

• Define a deliberate data-access strategy, including for new integrations such as AI tools and client access, so new data sources are never open by default.

• Make sure every decision and action in our systems is traceable.

• Monitor and, where needed, improve our alignment with NIS2.

• Prepare Eddy Grid for the new cybersecurity legislation.

• Answer security and compliance questions in tenders and from enterprise clients.

• Work with our infra/DevSecOps team and with external auditors or advisers who check that the framework works.

• You have a cybersecurity background and understand the technology: you can follow architecture, cloud infrastructure and access models, and talk to developers as a peer.

• You have experience setting up or running a security or risk framework (for example ISO 27001, NIS2 or similar).

• You think logically and in a structured way, and can quickly get to grips with new regulation and turn it into concrete measures.

• You are pragmatic: you look for the measure that actually reduces risk and fits a fast-growing tech company, not the heaviest process.

• You are comfortable being independent and stopping something when it isn't right.

• Experience with REMIT or other energy-market regulation is a plus.