OT Security Architect

Job Description: OT Security Architect

Job Title: OT Security Architect

Location: Newark, Delaware

Work Model: 100% Onsite – 5 Days per Week

Experience: 8+ Years in Cybersecurity, Network, or Infrastructure Engineering, including 4+ Years in OT/ICS Cybersecurity

Travel: Up to 25%

Reporting To: Chief Security Officer

Job Summary

We are seeking an experienced OT Security Architect to design, deploy, and operate cybersecurity solutions across industrial and manufacturing environments. This role focuses on protecting operational technology (OT), industrial control systems (ICS), programmable logic controllers (PLCs), SCADA, and human-machine interface (HMI) systems.

The ideal candidate will have extensive hands-on experience implementing OT security platforms, industrial network segmentation, secure remote access, asset discovery, endpoint protection, and backup and recovery solutions in live production environments.

This is a hands-on engineering role requiring the ability to deploy, configure, troubleshoot, and maintain OT security technologies across multiple manufacturing sites. Candidates with strategy-only, advisory-only, or assessment-only experience will not be considered.

Key Responsibilities

• Deploy, configure, and optimize OT security platforms, including endpoint protection, intrusion prevention systems (IPS), asset discovery, secure remote access, malware scanning kiosks, and PLC backup solutions.
• Manage the operational health of OT security tools, including agent coverage, sensor health, licensing, upgrades, version management, detection tuning, allowlisting, and exclusions.
• Design and implement IT/OT convergence controls, including Level 3.5 OT DMZ architecture, secure data flows, identity integration, patching pathways, and security monitoring.
• Implement defense-in-depth network segmentation using the Purdue Model and ISA/IEC 62443 zone-and-conduit architecture.
• Partner with network engineering teams to configure VLANs, firewalls, routing, switching, wireless connectivity, microsegmentation, inline IPS, and virtual patching.
• Conduct OT asset discovery and maintain accurate inventories of industrial assets, operating systems, firmware, and vulnerabilities.
• Integrate OT security telemetry with enterprise SIEM, SOAR, EDR/XDR, NDR, and vulnerability management platforms.
• Develop and implement risk-based vulnerability remediation strategies, including compensating controls for legacy and unsupported industrial systems.
• Implement and test PLC/HMI configuration backups, version control, golden-image recovery, and restoration procedures for production assets.
• Support OT incident response, threat investigation, containment, recovery, and root-cause analysis.
• Lead proof-of-concept evaluations, technology selection, production deployments, and security platform rollouts across multiple manufacturing facilities.
• Support cybersecurity risk assessments, compliance activities, audit requirements, and implementation of industrial security standards.
• Collaborate with manufacturing, automation, infrastructure, network engineering, and enterprise security teams to maintain secure and reliable production operations.

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Electrical Engineering, Computer Engineering, Industrial Engineering, or a related technical discipline, or equivalent practical experience.
• 8+ years of experience in cybersecurity, network engineering, or infrastructure engineering.
• At least 4 years of hands-on OT/ICS cybersecurity experience in live industrial or manufacturing environments.
• Demonstrated experience deploying and operating OT security technologies across multiple sites.
• Strong understanding of industrial control systems, PLCs, SCADA, HMIs, engineering workstations, and industrial networks.
• Hands-on experience with OT network segmentation, Purdue Model architecture, OT DMZs, firewall policies, and secure remote access.
• Experience with OT asset discovery, vulnerability management, endpoint protection, and security monitoring.
• Experience integrating OT security platforms with enterprise security monitoring and response solutions.
• Knowledge of Windows and Linux administration, Active Directory, virtualization, storage, backup, and network infrastructure.
• Ability to troubleshoot security technologies in production environments while minimizing operational disruption.
• Ability to work onsite in Newark, Delaware, five days per week, with occasional off-hours maintenance windows and travel of up to 25%.

Preferred Technical Skills

OT Security Platforms: Claroty, Nozomi Networks, Dragos, TXOne, Armis, Cisco Cyber Vision, or equivalent solutions.

Secure Remote Access: Dispel, KASM, brokered vendor access, jump hosts, MFA, session recording, privileged access management (PAM), and browser isolation.

OT Endpoint Protection: OT-native anti-malware, application allowlisting, endpoint protection for HMIs and engineering workstations, and legacy OS security.

OT Backup and Recovery: Octoplant, Salvador Technologies, PLC/HMI configuration backup, version control, and tested recovery procedures.

Network Security: OT DMZ, Purdue Model Levels 0–5, VLANs, firewalls, microsegmentation, inline IPS, virtual patching, routing, switching, VPN, NAT, and WAN connectivity.

Industrial Protocols: Modbus, DNP3, Profinet, OPC/OPC-UA, EtherNet/IP, and BACnet.

Industrial Automation: Siemens, Rockwell Automation, Schneider Electric, General Electric (GE), ABB, PLCs, SCADA, HMI, MES, historians, and LIMS.

Enterprise Security Integration: SIEM, SOAR, EDR/XDR, NDR, PAM, and vulnerability management platforms.

Scripting and Automation: Python and PowerShell for deployment, configuration management, reporting, and operational automation.

Security Standards: ISA/IEC 62443, NIST SP 800-82, industrial cybersecurity risk assessments, threat intelligence, and vulnerability management.

Preferred Certifications

• GIAC Global Industrial Cyber Security Professional (GICSP)
• GIAC Response and Industrial Defense (GRID)
• GIAC Critical Infrastructure Protection (GCIP)
• ISA/IEC 62443 certifications
• Certified Information Systems Security Professional (CISSP)
• Cisco Certified Network Professional (CCNP) or equivalent certifications

Additional Requirements

• Experience supporting multi-site or multinational manufacturing operations is preferred.
• Familiarity with ERC CIP requirements or utility customer cybersecurity requirements is a plus.
• Ability to work safely on active production floors and coordinate changes during approved maintenance windows.
• Strong problem-solving, communication, documentation, and cross-functional collaboration skills.
• Ability to balance cybersecurity controls with production availability, safety, and operational reliability.