Head of Information Security - CISO

Enlight is looking for a Head of Information Security (CISO) to lead the development and implementation of the company’s cybersecurity strategy, governance, and risk-management framework. The role will ensure that Enlight’s IT and operational technology (OT) environments, critical assets, data, and business operations are appropriately protected as the company grows and expands internationally. The CISO will establish and continuously improve the company’s information security capabilities, prioritizing initiatives based on risk exposure and business impact while enabling business growth and maintaining uninterrupted operations across renewable energy assets and corporate systems. Requirements: 10+ years of experience in cybersecurity, information security, IT/OT security, or a related field, including leadership responsibility. Proven experience developing and implementing cybersecurity strategies, policies, governance frameworks, and risk-mitigation plans, and familiarity with relevant cybersecurity frameworks and standards. Strong understanding of IT and OT security, preferably in critical infrastructure, energy, industrial environments, or other operationally sensitive industries. Experience with security risk assessments, Business Impact Analysis (BIA), asset criticality assessments, establishing SOC, IR, Suply Chain risks. Relevant professional certifications (e.g., CISSP, CISM, CISA, or equivalent) – preferred. Experience in renewable energy, power generation, construction, infrastructure, or industrial environments – preferred. Responsibilities: Cybersecurity Strategy & Governance: Define and implement the company-wide cybersecurity strategy, policies, standards, and governance framework, aligned with business priorities and risk exposure. IT & OT Security: Assess and mitigate cybersecurity risks across corporate IT systems, renewable energy assets, operational technology, and critical infrastructure, while maintaining production continuity. Risk Management & Business Impact: Lead Business Impact Analysis (BIA), identify and prioritize critical assets and vulnerabilities, and develop risk-based mitigation plans. Security Operations & Incident Response: Establish and oversee Security Operations Center (SOC) capabilities, security monitoring, incident response, and recovery processes. Security Architecture & Access Management: Define security requirements for infrastructure, applications, cloud environments, identity and access management, and remote access. Policies & Procedures: Develop and implement security policies, standards, procedures, and controls, ensuring they are practical, adopted, and regularly reviewed. Third-Party & Supply Chain Security: Assess and manage cybersecurity risks associated with vendors, service providers, technology partners, and critical infrastructure components. Incident Preparedness & Resilience: Establish incident response plans, conduct security assessments and exercises, and strengthen business continuity and recovery capabilities. Compliance & Assurance: Ensure alignment with applicable regulatory requirements, industry standards, contractual obligations, and internal audit recommendations. Security Awareness: Develop employee awareness and training programs to strengthen secure behaviors and accountability across the organization. Technology & AI Security: Define security requirements for the adoption of AI, automation, and emerging technologies, enabling their safe and responsible use.