CyberArk for OT (ICS/SCADA)

LTM; Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

A leading IT security firm is seeking a Senior Consultant to implement CyberArk Privileged Access Management in Operational Technology settings. Responsibilities include leading workshops for system integration, ensuring secure privileged access, and implementing control measures for vendor access. The ideal candidate should have substantial experience with CyberArk tools, a solid understanding of OT constraints, and the ability to work with diverse stakeholders in high-availability environments. Comprehensive documentation and governance practices are essential for this role.

Qualifications

• Strong hands-on experience implementing and operating CyberArk components.
• Proven experience onboarding and managing privileged accounts.
• Practical experience working in OT/ICS environments.

Responsibilities

• Lead discovery workshops to document OT asset inventory.
• Implement and configure CyberArk components as per scope.
• Design and implement controlled vendor access patterns.

Skills

CyberArk implementation

Windows and Linux administration

OT/ICS Security knowledge

Networking fundamentals

Controls engineering collaboration

Job description

Role Summary

We are seeking a Senior Consultant to lead the design and implementation of CyberArk Privileged Access Management (PAM) for Operational Technology (OT) environments at a Construction/Manufacturing customer. The role will secure and govern privileged access pathways into OT assets (SCADA/HMI, historians, engineering workstations, jump servers, OT servers, OT applications) while respecting OT constraints—segmented networks, high availability, legacy systems, limited patch windows, vendor access needs, and safety-critical operations. You will design OT access architecture (including industrial DMZ patterns), implement credential vaulting, session brokering and recording, and integrate with IT identity/MFA/ITSM/SIEM to deliver auditable, least-privilege privileged access with minimal operational disruption.

Key Responsibilities

• OT Privileged Access Architecture & Design – Lead discovery workshops with OT stakeholders (plant operations, controls engineers, maintenance, vendors, IT security) to document OT asset inventory and zones (engineering workstations, SCADA/HMI servers, historians, PLC access paths); privileged account landscape (local admins, domain admins, service accounts, vendor accounts); remote access patterns (VPN/ZTNA, jump hosts, vendor portals) and constraints. Define OT privileged access target architecture incorporating: industrial DMZ access patterns, bastion/jump server approach, identity controls (MFA, conditional access) where applicable. Create high-level and low-level designs (HLD/LLD), including security controls, network flows, firewall requirements, and operational runbooks.
• CyberArk Implementation (Core Delivery) – Implement and configure CyberArk components as per scope: Vault / PVWA, CPM, PSM, PSMP (as required). Onboard privileged accounts in OT scope, including: Windows local and domain privileged accounts (engineering workstations, SCADA/HMI servers); Linux/Unix privileged accounts (OT apps, historians, collectors); OT application/service accounts (historians, collectors, middleware, schedulers); Network devices / appliances (firewalls/switches in OT zones) if in scope. Configure password management: rotation schedules aligned with OT change windows; reconciliation processes and emergency rotation procedures. Implement privileged session access: RDP/SSH brokering via PSM/PSMP; session recording policies, command controls (where applicable); least-privilege access workflows for OT administrators and vendors.
• Vendor and Contractor Access (OT-Focused) – Design and implement controlled vendor access patterns: time-bound, approved access windows; brokered sessions via jump hosts; session recording and accountability. Reduce/replace shared local admin usage with named access wherever feasible. Define and implement break-glass procedures aligned to safety and operational needs.
• Integration (IT/OT Convergence) – Integrate CyberArk with enterprise services: AD/LDAP for identity and group-based access; MFA/IdP integration (Okta/Entra) where required for privileged workflows; ITSM (ServiceNow/Jira) for approvals, exception handling, and evidence; SIEM (Splunk/Microsoft Sentinel) for audit and detection use cases. Collaborate with network/security teams to implement connectivity in segmented OT networks and DMZs.
• Documentation, Training, and Governance – Produce artifacts suitable for regulated and audit environments: HLD/LLD, SOPs/runbooks, as-built documents, test evidence, support playbooks. Conduct training for OT admins/support teams: how to access OT assets through CyberArk; how to request/approve vendor access; how to handle emergencies and break-glass.

Skills

• Must Have CyberArk – Strong hands-on experience implementing and operating: CyberArk PVWA, CPM, PSM, PSMP, Vault fundamentals.
• Proven experience onboarding and managing: Windows local/domain privileged accounts; Linux/Unix privileged accounts; service/application accounts and handling dependencies.
• Strong knowledge of: credential rotation/reconciliation strategies; session management, recording, and audit trails; safe design, role design, and least privilege.
• OT / ICS Security – Practical experience working in OT/ICS environments (manufacturing, construction plants/sites, industrial facilities). Solid understanding of OT access patterns and constraints: segmented OT networks and industrial DMZ concepts; engineering workstation and vendor access realities; safety/availability considerations and strict change control.
• Ability to work effectively with controls engineers, plant ops, and vendors; Infrastructure & Networking – Strong knowledge of Windows and Linux administration concepts relevant to PAM. Networking fundamentals: DNS, routing, firewall rules, ports, RDP/SSH, proxies. Troubleshooting complex connectivity across segmented networks/DMZ.

Nice to Have

• Familiarity with OT security frameworks and approaches (zones/conduits mindset, risk-based segmentation).
• Experience integrating CyberArk with: Okta/Entra ID/ (MFA/IdP); ServiceNow/Jira (approvals/evidence); SIEM tooling for audit analytics and alerting.
• Experience securing remote vendor access solutions (jump servers, VDI/Citrix, ZTNA).
• Knowledge of OT security monitoring platforms and how PAM complements them.