OT Cybersecurity Implementation Engineer

Role overview

Implementation and testing

• Deploy industrial firewalls, switches, and VLANs to enforce approved zones, conduits, IT/OT DMZs, and operationally reviewed rules.
• Implement controlled remote and vendor access with jump servers, MFA, session recording, and time-limited accounts; retire unmanaged connections.
• Install and tune passive OT monitoring sensors on SPAN or TAP ports and integrate logs and alerts with the client SIEM or SOC.
• Harden HMIs, engineering workstations, servers, and network devices; apply patches and fixes in vendor-approved, change-controlled windows.
• Deploy application whitelisting or endpoint protection and establish backup and recovery for control-system assets.
• Prepare and run FAT and SAT, confirm controls do not affect process behavior, and support commissioning.

Documentation and handover

• Produce as-built diagrams, configuration records, procedures, and test reports.
• Train client operations and engineering staff to operate and maintain the installed systems.

Experience and education

• Requires 5+ years in network or security engineering, including 2–3 years implementing security controls in industrial or OT environments.
• Requires hands-on OT security project delivery through FAT, SAT, and commissioning.
• Suitable backgrounds include network or security engineering moving into OT, or control and automation engineering moving into security.
• Requires experience in live plants under permits, safety rules, and strict change control.
• Requires a bachelor’s degree in Engineering, Computer Science, IT, or a related field.

Technical skills and frameworks

• Network security includes industrial and enterprise firewalls (Fortinet, Palo Alto, Cisco), VLANs, routing, VPN, network access control, and Purdue-based segmentation.
• Remote access includes jump servers, MFA, privileged access, and session recording tools.
• OT monitoring may use Nozomi, Claroty, Dragos, Tenable OT, Forescout, or Armis, plus SPAN/TAP deployment and SIEM integration.
• Hardening and endpoint skills include Windows Server and Active Directory, CIS baselines, application whitelisting, endpoint protection, VMware or Hyper-V, and backup tools.
• Industrial systems include PLC, DCS, SCADA, and HMI platforms from Siemens, Rockwell, Schneider, Honeywell, ABB, or Emerson; protocols include Modbus, DNP3, OPC, and IEC 104.
• Frameworks include NCA OTCC, IEC 62443, and NIST SP 800-82.

Certifications and communication

• Requires at least one network or firewall vendor certification (NSE 4 or higher, PCNSE, CCNP) or equivalent proven experience.
• GICSP, ISA/IEC 62443 Fundamentals or Design Specialist, and Windows Server or VMware certification are preferred.
• Clear written and spoken English is required; Arabic is an advantage.

Working conditions

• Work is onsite for most of the implementation period, with travel and site safety inductions.
• Work within change windows and permits; never make a change without an approved plan and rollback.
• Collaborate with plant operators, control engineers, and vendors who prioritize uptime; document configuration and test evidence as work progresses.