Chief Information Security Officer (CISO)
Return (battery energy storage, €300M raised) seeks a CISO to own the full security and compliance picture across IT and OT: NIS2/KRITIS regulatory work, ISO 27001 maintenance, a new IEC 62443 certification program, and vendor security contracts. Reports to the CTO; needs hands-on technical credibility (Terraform, Kubernetes, Modbus/OPC-UA) plus comfort with heavy documentation.
- Compensation
- Not disclosed
- Location
- Amsterdam, NL
- Work setup
- Hybrid
- Seniority
- C level
- Employment
- Full time
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- Hands-on security leadership in a regulated industry or critical infrastructure (energy, industry, telecom, finance, healthcare)
- Has personally run a security program
- Willingness to do the paperwork: NIS2/KRITIS records, policies, evidence, audit prep, incident reporting procedures
- Willingness to read local regulation in four countries (NL Cyberbeveiligingswet/RDI, DE BSIG/EnWG/BNetzA, ES INCIBE-CERT, BE CCB)
- Influence without formal control over teams that do not report to you
- Speed: prefer shipping practical controls quickly over elaborate frameworks
- Technical credibility: read Terraform modules, reason about Kubernetes RBAC and NetworkPolicies, understand Modbus/OPC-UA exposure, argue threat models
- Practical skill in threat modeling, segmentation, secrets management, audit logging, and secure remote access
- Fluency with frontier AI tools and extracting real value from them
- Professional-level English
- Live in the EU with the right to work there
- Pass a background check before final offer
- Willingness to travel to battery sites, operations centers, and regulator/auditor meetings
Nice to have
- Comfort with OT: SCADA-adjacent systems, industrial protocols, or vendor-managed site equipment
- Dutch or German (for regulator communication)
Full description
Return is hiring a CISO. We build and operate industrial-size Battery Energy Storage Systems. This is critical energy infrastructure, and it needs one owner for security and compliance.
We operate in the Netherlands, Germany, Belgium, and Spain. You will make a measurable impact on the energy transition at country level. Return recently raised €300M to support its growth.
We employ more than 150 people. The technical team consists of 24 people. Our platform automates work in energy storage, monitoring, market optimization, sales, project management, procurement, construction, and customer service. It runs on EU cloud and on compute at the battery sites. We run the fleet from two operations centers in the Netherlands.
In our first four years we built the platforms and passed the important audits. Now we need one person to own the whole security picture. Today the work sits with the CTO, the platform team, and the Head of OT. That does not scale.
You report to the CTO and have direct access to the management board.
What you will own
Security standards for IT and OT. You propose the risk appetite to the management board. You set the standards and the requirements, and other teams implement them. The Head of OT owns network security at the battery sites. The platform team owns the cloud and the application infrastructure. You give them the framework, and you verify that it holds. You must be a credible counterpart to both. A reviewer who arrives at the end of the process will not work here.
Regulatory compliance. We fall under NIS2 and its national transpositions. Parts of our German pipeline approach the KRITIS thresholds. You read the legislation. You decide what applies to us. You write the policies, and you file what must be filed. You own this work end to end. The management board approves it, as NIS2 requires.
ISO 27001. We are certified, and we intend to stay certified. We also plan to extend the certified scope to our newer platforms and the operations centers. The work covers surveillance audits, the risk register, the statement of applicability, corrective actions, the internal audit program, and supplier assessments.
IEC 62443 certification. This program is new. The scope is IEC 62443-2-1 for our security program, and IEC 62443-3-2 and 3-3 for the site systems. You run it from start to finish: gap assessment, security level targets, and certification. You work with the Head of OT on zones, conduits, and any change to the live site network. Plan for close cooperation, not a handover.
Vendor and contract work. Our battery suppliers, EMS providers, and connectivity partners need security requirements in their contracts. Someone must negotiate them. Expect real time on Annex L documents, DPAs, and supplier audits.