Chief Information Security Officer (CISO)

Return; Amsterdam; Remote; EUR 120,000 - 180,000; Full time

Job summary

Return is hiring a CISO to own the entire security program for IT, OT, and cloud across multiple European sites. You will report to the CTO and work directly with the management board to set risk appetite and drive security standards, audits, and policy enforcement.

In this role you will lead regulatory compliance, oversee ISO 27001 scope, and drive IEC 62443 certification from gap analysis to final certification.

Qualifications

• Hands-on security leadership in regulated industries or critical infrastructure.
• Experience writing and enforcing security policies and standards.
• Ability to drive security programs across IT, OT, and cloud platforms.

Responsibilities

• Own security standards for IT and OT across the platform and sites.
• Lead regulatory compliance efforts including NIS2, KRITIS, and related policies.
• Manage ISO 27001 scope, audits, and supplier assessments.
• Oversee IEC 62443 certification work from gap assessment to certification.
• Negotiate security requirements in vendor and contract documents.
• Collaborate with CTO, Head of OT, and platform teams to enforce security controls.

Skills

Security leadership

Regulatory compliance

Threat modeling

OT/IT security

Cloud security

Tools

Terraform

Kubernetes

Network policies

Modbus/OPC-UA

Job description

Return is hiring a CISO. We build and operate industrial-size Battery Energy Storage Systems. This is critical energy infrastructure, and it needs one owner for security and compliance.

We operate in the Netherlands, Germany, Belgium, and Spain. You will make a measurable impact on the energy transition at country level. Return recently raised €300M to support its growth.

We employ more than 150 people. The technical team consists of 24 people. Our platform automates work in energy storage, monitoring, market optimization, sales, project management, procurement, construction, and customer service. It runs on EU cloud and on compute at the battery sites. We run the fleet from two operations centers in the Netherlands.

In our first four years we built the platforms and passed the important audits. Now we need one person to own the whole security picture. Today the work sits with the CTO, the platform team, and the Head of OT. That does not scale.

You report to the CTO and have direct access to the management board.

What you will own

Security standards for IT and OT. You propose the risk appetite to the management board. You set the standards and the requirements, and other teams implement them. The Head of OT owns network security at the battery sites. The platform team owns the cloud and the application infrastructure. You give them the framework, and you verify that it holds. You must be a credible counterpart to both. A reviewer who arrives at the end of the process will not work here.

Regulatory compliance. We fall under NIS2 and its national transpositions. Parts of our German pipeline approach the KRITIS thresholds. You read the legislation. You decide what applies to us. You write the policies, and you file what must be filed. You own this work end to end. The management board approves it, as NIS2 requires.

ISO 27001. We are certified, and we intend to stay certified. We also plan to extend the certified scope to our newer platforms and the operations centers. The work covers surveillance audits, the risk register, the statement of applicability, corrective actions, the internal audit program, and supplier assessments.

IEC 62443 certification. This program is new. The scope is IEC 62443-2-1 for our security program, and IEC 62443-3-2 and 3-3 for the site systems. You run it from start to finish: gap assessment, security level targets, and certification. You work with the Head of OT on zones, conduits, and any change to the live site network. Plan for close cooperation, not a handover.

Vendor and contract work. Our battery suppliers, EMS providers, and connectivity partners need security requirements in their contracts. Someone must negotiate them. Expect real time on Annex L documents, DPAs, and supplier audits.

What we expect

Hands-on security leadership in a regulated industry or in critical infrastructure. Energy, industry, telecom, finance, and healthcare all count. You have run a security program yourself.

Willingness to do the paperwork. Much of this role is documentation: NIS2 and KRITIS records, policies, evidence, audit preparation, and incident reporting procedures. For us this is the job, not the dull part of it.

Willingness to read local regulation. We work in four countries with four implementations: the Dutch Cyberbeveiligingswet with RDI supervision, the German BSIG, EnWG, and BNetzA IT-Sicherheitskatalog, the Spanish framework with INCIBE-CERT, and the Belgian transposition with CCB guidance. You do not need to know all of these on day one. You do need to read them.

Influence without formal control. You will steer teams that do not report to you. You must be right often enough that they listen.

Speed. We prefer the boring control that ships this quarter over the elegant framework that ships next year. Security must not slow delivery down without a clear reduction in risk. In a team this small we notice quickly.

Technical credibility. You can read a Terraform module. You can reason about Kubernetes RBAC and NetworkPolicies. You understand what a Modbus or OPC-UA link exposes across a site boundary. You can argue a threat model on its merits. You will not run the OT network, but you must be able to challenge its design.

Practical skill in threat modeling, segmentation, secrets management, audit logging, and secure remote access.

Fluency with AI tools. We use frontier AI models heavily, including for security work. You know how to get real value from them.

Comfort with OT. Experience with SCADA-adjacent systems, industrial protocols, or vendor-managed site equipment is a strong plus. We can teach you the energy domain. We cannot teach patience with an OEM that asks for a permanent VPN tunnel into a substation.

English at a professional level. Dutch or German is a plus, because you will speak with the regulators.

Practicalities

We operate critical infrastructure, so the role requires a background check before a final offer. We explain what it involves early in the process. There are no surprises at the end.

Return has offices in Amsterdam, Berlin, Brussels, Hamburg, Munich, Madrid, and Stuttgart. You can work remotely if you live in the EU and have the right to work there. Expect travel to the battery sites, the operations centers, and the occasional meeting with a regulator or an auditor. It is not the day job.

We keep meetings to a minimum. Most people in the technology teams get at least five hours of uninterrupted focus time per day. Expect less in this role: negotiations, audits, and regulator meetings take real time. You are also part of the incident escalation chain, because NIS2 requires an early warning within 24 hours of a significant incident.

Our hiring process is thorough, and it takes time. First a short call to get acquainted, in which we share the salary range. Then one or more technical interviews. Then a paid visit to Amsterdam to meet the team. Last, the background check. Expect several weeks end to end. We would rather move carefully on a role like this than rush it.