Senior OT Risk Assessment Analyst

NES Fircroft; Kolding; Hybrid; DKK 673,000 - 972,000; Full time

Job summary

NES Fircroft in Denmark is seeking a Senior OT Risk Assessment Analyst to join a key energy client on a 1-year contract with extension potential. The role supports hybrid office-based work in Kolding (2 days/week) or remote for suitable candidates.

You will lead end-to-end OT risk assessments, apply IEC 62443 and ISO/IEC 27001 risk management, and translate findings into actionable security requirements for industrial environments across SCADA, PLCs, HMIs and OT networks.

Qualifications

• OT/ICS security and industrial risk assessment experience required.
• IEC 62443 and ISO/IEC 27001 family risk management knowledge.
• Energy/utilities or critical infrastructure experience preferred.

Responsibilities

• Plan and drive end-to-end OT cyber and operational risk assessments across complex industrial environments.
• Apply IEC 62443-3-2, risk assessment, zones/conduits, threat scenarios and SL-T; translate risks into security requirements.
• Assess asset criticality, threats, vulnerabilities, likelihood, operational consequences, and risk treatments.
• Demonstrate strong OT/industrial domain knowledge (SCADA, PLCs, HMIs, OT networks).
• Analyze OT architectures, zones, trust boundaries, data flows and dependencies on IT/vendors/remote services.
• Lead structured risk-identification workshops with cross-functional teams.
• Assess risk in operational and business context (availability, safety, production, environment).
• Consolidate findings into portfolio-level OT risk picture and actionable reports.
• Mature OT risk registers and risk-management processes with clear ownership and traceability.
• Translate risks into treatment requirements and high-level solution scopes.

Skills

OT/ICS security

Risk assessment

IEC 62443

ISO/IEC 27001

Industrial engineering

Education

BSc/MSc in Cyber Security or related

IEC 62443 training

ISO/IEC 27001/27005 training

Job description

NES Fircroft are supporting a key energy client in Denmark, with a Senior OT Risk Assessment Analyst role.

This will be a 1 year contract, with the view of being extended longer term, and although the client would prefer the individual to be office based 2 days per week (Kolding, Southern Denmark), they will consider a remote candidate, if they are deemed suitable.

For this role, the candidate must have sufficient OT and industrial understanding to determine how technical weaknesses, failures or compromises translate into operational and business risk.

Responsibilities

• Plan, structure and drive end-to-end OT cyber and operational risk identification and assessments across complex industrial environments, including identification of unknown or undocumented risks
• Apply IEC 62443, particularly IEC 62443-3-2, including risk assessment, zones and conduits, threat scenarios and Target Security Levels (SL-T), and translate identified risks into security requirements and treatments
• Assess asset/system criticality, threats, vulnerabilities, likelihood, operational consequences, inherent/residual risk and appropriate risk treatments
• Demonstrate strong OT/industrial domain knowledge, including SCADA, PLCs, HMIs, engineering workstations, OT networks, remote/vendor connectivity and legacy/EOL technology
• Analyse OT architectures and dependencies, including zones, conduits, trust boundaries, critical data flows and dependencies on IT, vendors/OEMs, remote access and external services
• Lead structured risk-identification workshops with TA2/TA3, Engineering, Operations, Security and asset/system owners, using strong facilitation skills to uncover undocumented risks and challenge assumptions
• Assess risk in its operational and business context, considering availability, safety, production, environment, maintainability and regulatory/compliance impact, rather than technical severity alone
• Consolidate individual findings into a consistent portfolio-level OT risk picture, identifying systemic risks, asset-specific risks, dependencies, concentrations and recurring risk themes
• Mature OT risk registers and risk-management processes, including consistent risk statements, ratings, ownership, traceability, prioritisation and management-level reporting across organisational boundaries
• Translate prioritised risks into risk-treatment requirements and high-level solution scopes, enabling management, Technical Authorities and Engineering to make informed, risk-based decisions and progress subsequent engineering activities

Skills required

• Relevant technical/security education or equivalent senior professional experience
• Strong practical OT/ICS security and industrial risk-assessment experience
• Demonstrated practical knowledge of IEC 62443 and ISO/IEC 27001-family risk management, particularly IEC 62443-3-2 and ISO/IEC 27005
• Experience applying risk-management principles within industrial/OT environments, not solely traditional IT/GRC environments
• BSc/MSc in Cyber Security, Automation/Control Engineering, Electrical Engineering, Industrial Engineering, Risk Management or related discipline
• IEC 62443 training/certification
• ISO/IEC 27001 and/or ISO/IEC 27005 training, certification or recognised risk-management qualification
• Experience with ISO/IEC 27019 in the energy/utility sector. ISO describes ISO/IEC 27019:2024 specifically as information-security controls for the energy utility industry
• GICSP, CISSP, CISM, CRISC or comparable relevant professional certification
• Experience from energy, utilities, renewables or comparable critical infrastructure
• Fluent in English

With over 90 years' combined experience, NES Fircroft (NES) is proud to be the world's leading engineering staffing provider spanning the Oil & Gas, Power & Renewables, Chemicals, Construction & Infrastructure, Life Sciences, Mining andManufacturingsectors worldwide. With more than 80 offices in 45 countries, we are able to provide our clients with the engineering and technical expertise they need, wherever and whenever it is needed. We offer contractors far more than a traditional recruitment service, supporting with everything from securing visas and work permits, to providing market-leading benefits packages and accommodation, ensuring they are safely and compliantly able to support our clients.