Energy cyber security jobs: what may change

Proposed DESNZ cyber resilience requirements for downstream gas and electricity could have consequences well beyond dedicated security teams. Employers may need more people who understand operational technology (OT), control systems, software assurance, data, networks and regulated engineering environments.

Why the proposals matter for recruitment

The Department for Energy Security and Net Zero proposals concern cyber resilience in essential energy operations. As the requirements are still proposed, candidates and employers should check the published consultation and any subsequent government response before relying on details about scope, deadlines or mandatory controls.

The direction of travel nevertheless matters for workforce planning. Turning a cyber requirement into day-to-day resilience is rarely just a matter of buying security software. Operators and their suppliers need people who can understand assets, identify risks, implement proportionate controls, test recovery arrangements and produce evidence that work has been completed correctly.

That can create or reshape work across several areas:

• OT and industrial control system security
• control systems and software engineering
• network architecture and secure communications
• asset inventory and configuration management
• cyber risk, governance and assurance
• incident response and operational recovery
• supplier and third-party assurance
• data engineering, monitoring and reporting
• commissioning, maintenance and engineering change

The strongest demand may not always appear under the job title “cyber security”. Relevant responsibilities can sit within systems engineering, commissioning, infrastructure, software assurance, instrumentation or technical governance roles.

OT security is not the same as office IT security

Energy infrastructure combines conventional information technology with physical processes. OT can include industrial networks, sensors, programmable controllers, supervisory systems and the engineering workstations used to configure them.

In an office environment, replacing or isolating a device may be relatively straightforward. In an operational plant, any intervention must also consider safety, availability, process stability, maintenance windows and the consequences of an incorrect change. Older equipment may have long service lives or limited support for modern security tools.

This is why employers value professionals who can connect cyber principles with engineering reality. An OT security specialist needs to communicate with operators, maintainers, control and instrumentation engineers, software teams, safety specialists and senior decision-makers.

Useful knowledge can include:

• network segmentation and controlled remote access
• secure configuration and change control
• vulnerability assessment in operational environments
• asset identification and dependency mapping
• logging, monitoring and incident investigation
• backup, restoration and disaster recovery testing
• safety, security and availability trade-offs
• documenting risks, decisions and assurance evidence

Candidates should not claim OT competence solely on the basis of corporate IT experience. They should instead show where their existing skills transfer and where they need plant-specific learning.

Jobs implications for the Cumbrian cluster

Cumbria’s nuclear, defence and advanced-manufacturing employers operate complex assets and supply chains. Although the proposed DESNZ requirements relate to downstream gas and electricity, the resulting skills demand is likely to overlap with capabilities already used across safety-conscious and highly controlled industries.

That overlap matters for both recruitment and career mobility. A control systems engineer may understand deterministic processes and safe change. A commissioning engineer may be experienced in test procedures, fault resolution and evidence packs. A software assurance specialist may know how to demonstrate that code and development processes meet defined requirements. A network engineer may bring segmentation, access control and infrastructure monitoring experience.

Employers recruiting for energy cyber resilience should therefore look beyond applicants who already have “OT cyber” in their title. Potentially relevant candidates may come from:

• nuclear operations and decommissioning
• defence systems and secure communications
• industrial automation and manufacturing
• utilities, process engineering and instrumentation
• safety case, quality and independent assurance work
• infrastructure and enterprise technology teams

Transferability still needs to be assessed carefully. Security clearance, site access, sector regulation, technology platforms and required professional certifications will vary by vacancy. Applicants should check each job description rather than assume that experience in one regulated sector automatically meets another sector’s requirements.

Relevant roles currently advertised

Current vacancies on the site illustrate the breadth of the potential skills pipeline.

Sellafield Ltd is advertising a Lead Cyber Security Consultant role at Sellafield or Risley with a listed salary of £82,224. This is the clearest direct cyber opportunity among the current listings, although candidates should check the vacancy itself for its balance of operational, enterprise, governance and leadership responsibilities.

BAE Critical Skills has a Principal Software Engineer (Control Systems) vacancy in Barrow-in-Furness at £47,700.42, as well as a Principal Engineer – Software Engineering (Assurance) role at £43,666.43. These are not presented as downstream energy jobs, but control systems and assurance experience can be highly relevant to wider OT resilience careers.

Other adjacent vacancies include:

• Network Engineer with Empowered SMS in Barrow-in-Furness, listed at £117,000–£130,000
• VMware Engineer with Experis in Barrow-in-Furness, listed at £124,800–£137,800
• IS Applications Lead with Morson Edge in Barrow-in-Furness, listed at £91,468.41
• Principal Engineer – Systems Engineering with BAE Systems in Barrow-in-Furness
• Principal Engineer (External Communications Integration) with BAE Systems in Barrow-in-Furness
• Instrument Technician with Morson Edge in Roose, listed at £47,958.23

These advertised salaries should not be treated as market benchmarks for energy cyber security jobs. Contract status, working pattern, clearance requirements and specialist experience can materially affect a package. Check the full advert for current terms and availability.

What candidates should demonstrate

Candidates moving towards OT cyber should build evidence around outcomes rather than relying on security terminology. Strong examples could include controlling an engineering change, investigating an equipment fault, improving network visibility, testing restoration procedures or producing assurance evidence for a critical system.

A useful application should explain:

• what system or process was involved
• the operational or security risk
• the candidate’s individual responsibility
• how safety and availability were protected
• which stakeholders had to approve the work
• what testing and documentation were completed
• how the result was verified

Career changers should identify gaps honestly. Training in networking, industrial protocols, control systems or cyber risk can help, but practical understanding of operational constraints is equally important.

What hiring managers should consider

If new requirements increase recruitment activity, narrowly specified vacancies could make an already specialist search harder. Hiring managers should separate essential capability from technology or sector experience that can be taught.

Job descriptions should make clear whether a role is primarily hands-on engineering, security architecture, monitoring, assurance or programme delivery. They should also explain any on-site expectations, clearance conditions and responsibility for safety-related systems. This helps candidates judge whether their IT, OT or engineering background is genuinely suitable.

Next steps

Explore current jobs across cyber, software, systems engineering, networks, commissioning and assurance. Create tailored job alerts for terms such as OT security, control systems, cyber assurance and industrial networks, or use the career guide to plan a move into the sector.