Plant Security Specialist

Are you on the lookout for your next big career move?
Vestas Technology & Operations > Research & Development (R&D) > Software Product Delivery and SecuritySoftware Product Delivery and Security is the platform engineering and DevOps enablement team at Vestas, responsible for building, running, securing, and evolving the Internal Developer Platform
- the shared infrastructure, tooling, and practices that hundreds of application developers rely on to develop, deliver, and operate their software.
We own and continuously enhance the security posture of the platform, including Kubernetes clusters, CI/CD pipelines, observability stack, secrets management, and source code hosting, ensuring secure-by-design and secure-by-default capabilities across software delivery for the Turbine and Power Plant domains.
This includes embedding cybersecurity controls, supporting vulnerability management, enforcing secure development practices, and aligning with industry standards for industrial and enterprise cybersecurity.
We are a small, tight-knit team split between Aarhus, Denmark, and Porto, Portugal.
Everyone owns a real domain and operates with a high degree of self-direction
- while maintaining a shared sense of responsibility for both platform reliability and cybersecurity.
We stay closely aligned, quickly address risks, and take each other's operational and security challenges seriously.
ResponsibilitiesMonitor, track, and manage reported vulnerabilities across power plant products, systems, and supporting infrastructurePerform vulnerability analysis, including assessing exploitability and determining potential impactCalculate and maintain risk scores using CVSS and internal risk assessment methodologiesPrioritize vulnerabilities based on risk, business impact, and operational criticalityDefine and coordinate mitigation and remediation plans, including patch management activitiesCollaborate with engineering, operations, and security teams to ensure timely resolution of vulnerabilitiesMaintain visibility of vulnerability status and provide regular reporting to stakeholdersEnsure alignment with cybersecurity standards, particularly IEC *, in vulnerability handling processesQualificationsBachelor's degree in Computer Science, Cybersecurity, Engineering, or a related field (or equivalent experience)Minimum of 5 years of practical experience, mainly with vulnerability management platforms and toolsSolid knowledge of vulnerability assessment frameworks, including CVSSFamiliarity with industrial cybersecurity standards, especially IEC *, including SL-C and SL-T conceptsUnderstanding of asset inventory management and configuration management practicesFluency in English (written and spoken)CompetenciesSolid analytical skills with the ability to assess technical vulnerabilities and translate them into business riskProficiency in risk-based prioritization and decision‐making in complex, safety‐critical environmentsSolid understanding of CVSS scoring and the ability to apply or adapt custom risk modelsEffective communication skills, with the ability to convey technical findings to non‐technical stakeholdersSolid organizational skills, with attention to detail and the ability to manage multiple vulnerabilities simultaneouslyCollaborative mindset, working effectively across security, engineering, compliance, and operations teamsProblem‐solving ability and a forward‐thinking approach to risk mitigationWhat

We Offer
We offer an environment where your interest in continuous learning and development can truly thrive.
You will join an informal, agile workplace that provides a high degree of ownership in shaping the path forward.
While we expect our team members to take full responsibility for their tasks and deadlines, we equally value celebrating achievements and learning from setbacks together.
Additional informationThis is a hybrid position based in Porto, Portugal, and requires up to 5 travel days per year.
Please note: We reserve the right to amend or withdraw this job posting at any time.
Our commitment to a fair hiringAt Vestas, we evaluate all candidates solely based on their professional experience, education, and relevant skills.
To support a fair recruitment process, we kindly ask that you remove any photos, dates of birth or graduation, gender pronouns, marital status, or other personal information not relevant to the role before submitting your CV/resume.
Your CV/resume should focus on your professional and educational background, along with the necessary contact details (email and phone number).
We train our hiring teams in inclusive evaluation and regularly review process outcomes to ensure fairness.
DEIB StatementAt Vestas, we recognize the value of diversity, equity, and inclusion in driving innovation and success.
We strongly encourage individuals from all backgrounds to apply, particularly those who may hesitate due to their identity or feel they do not meet every criterion.