Job description

Role purpose

Support the security and resilience of operational technology (OT) and industrial control system (ICS) environments.

Monitor and investigate security events, improve asset and monitoring coverage, coordinate remediation and recovery readiness, and support incident response and project assurance.

Work closely with Operations, Engineering, IT, the SOC and vendors, ensuring security actions do not create unacceptable safety or production risk.

Key responsibilities

• Monitor and triage alerts from SIEM, passive OT monitoring, firewalls, endpoint tools and other available telemetry; validate activity against approved operations and changes, correlate evidence, document findings and escalate incidents.
• Support OT incident assessment, containment and recovery with authorized stakeholders.
• Assess safety, availability and recoverability impacts; do not scan, isolate, block or change production systems without approval.
• Maintain asset, ownership, criticality and monitoring coverage records; identify blind spots and log-source issues, and validate sensor, collector and alerting health.
• Review OT vulnerabilities and exposures, coordinate safe patching or compensating controls, and track actions to evidence-based closure.
• Review segmentation, firewall rules and remote access for unnecessary exposure.
• Check backup and recovery readiness for critical systems and support restoration exercises; coordinate secure, least-privileged vendor access and review OT identity and privileged accounts.
• Provide cybersecurity input to OT projects and changes, including designs, data flows, zones and conduits, vendor connections and acceptance testing. Keep procedures, incident records, action trackers and concise status reports current.

Skills

Required qualifications and experience

• Bachelor's degree in cybersecurity, computer science, IT, electrical, instrumentation and control, automation, telecommunications engineering or a related discipline.
• At least 5 years of relevant technical experience, including 3 years hands-on in OT/ICS or industrial environments; experience supporting production or safety-sensitive operations.
• Practical experience in security monitoring or investigation and at least some of: industrial networking, firewalls, log management, asset visibility, vulnerability handling or incident response.
• Ability to work with Operations, engineers and equipment vendors and to produce clear technical records and reports.
• Technical knowledge Working knowledge of DCS, SCADA, PLCs, HMIs, industrial networks and protocols; Purdue architecture and ISA/IEC 62443 zones and conduits; SIEM and passive OT monitoring; alert investigation, network analysis, incident evidence handling, vulnerability assessment and secure remote access.
• Familiarity with NIST SP 800-82, MITRE ATT&CK for ICS and comparable OT monitoring, firewall or remote-access platforms is an advantage. Candidates need not have used every product in the environment.
• Preferred Experience in oil and gas, energy, utilities, petrochemical, manufacturing or other critical infrastructure; exposure to shutdowns, commissioning, OT recovery exercises or SOC operations.
• GICSP or GRID certification is an advantage