Operational Technology Security Architect - OTSA 26-15128

• Deploy, configure, and tune OT security platforms across manufacturing sites, including endpoint protection, inline IPS, asset discovery, secure remote access, media scanning kiosks, and PLC backup. This covers rulesets, allowlists, exclusions, and detection tuning on production assets.
• Own the operational health of deployed tooling: agent coverage, sensor health, license utilization, upgrades, and version currency.
• Design and implement IT/OT convergence controls: OT DMZ at Level 3.5, brokered access, data flows, identity and directory integration, patching paths, and monitoring feeds.
• Implement defense-in-depth segmentation aligned to the Purdue model and ISA/IEC 62443 zone-and-conduit design, including VLANs, rulesets, micro segmentation, and virtual patching for legacy assets. Partner with Network Engineering on switching, routing, firewalls, wireless, IIoT, edge, and WAN.
• Run OT asset discovery and integrate telemetry into enterprise SIEM, EDR/XDR, NDR, and vulnerability management. Maintain the inventory and drive end-of-life OS remediation.
• Implement and test PLC/HMI backup, versioning, and golden-image recovery.
• Support OT incident response and recovery.
• Lead POCs and production rollouts for new OT security technologies., * Secure Remote Access: brokered vendor and engineer access to Levels 0-3, session recording, MFA, jump hosts, browser isolation.
• Malware Scanning Kiosks: USB and vendor media inspection at plant entry points, scan engines, sanitization, and media workflows.
• OT Endpoint Security: OT-native anti-malware and application allow listing on HMIs, engineering workstations, and legacy or unsupported OS.
• OT Backup: PLC/HMI and production equipment configuration backup, version control, and tested golden image restore on production assets.
• Network Segmentation: OT DMZ at Level 3.5, zone-and-conduit design, VLAN-to-firewall migration, micro segmentation, inline IPS, and virtual patching.
• OT Vulnerability Management: passive and active OT asset discovery, risk-based prioritization, compensating controls for non-patchable assets.
• Purdue Model: applied Levels 0-5 data-flow design and enforcement of trust boundaries across live plants.

Platforms and Tools

• OT security platforms: TXOne, Claroty, Nozomi Networks, Dragos, Armis, KASM, Dispel, Salvador Technologies, OPSWAT, Octoplant, Cisco Cyber Vision / Catalyst IE, or equivalent.
• Enterprise security integration: SIEM, SOAR, XDR/EDR, NDR, PAM, and vulnerability management platforms.
• Windows and Linux server administration, Active Directory, virtualization, storage, backup, and hybrid cloud connectivity.
• Layer 2/3 switching and routing, VLANs, wireless, firewall rule design, NAT, VPN, and WAN connectivity.
• Scripting and automation (PowerShell, Python) for deployment, configuration management, and reporting at scale.
• PLC platforms (Siemens, Rockwell, Schneider, ABB), SCADA, and HMI systems.
• Industrial protocols: Modbus, DNP3, Profinet, OPC/OPC-UA, EtherNet/IP, BACnet.

Standards and Industry Experience

• Applied ISA/IEC 62443 and NIST SP 800-82: implementing controls, audit support, risk assessment, threat intelligence, and vulnerability management.
• Multi-site, multi-country manufacturing support experience; MES, historian, LIMS, and quality systems exposure.
• ERC CIP audit or utility customer cyber security requirement support.

Certifications

• GICSP, GRID, GCIP, GPPA, ISA/IEC 62443 Fundamentals or Specialist, CISSP, CCNP, or equivalent.

• Bachelor’s degree in Cybersecurity, Computer Science, Electrical Engineering, Industrial Engineering, Computer Engineering, or a related technical discipline, or equivalent hands-on experience.
• 8+ years of cyber security, network, or infrastructure engineering experience.
• 4+ years of hands-on OT/ICS cyber security in production industrial or manufacturing environments.
• Demonstrated hands-on deployment and operation of OT security tooling at multiple sites.
• Strategy-only, advisory-only, or assessment-only backgrounds will not be considered.