Operational Technology Security

Indigo Beam; Monaca (Beaver County); Presencial; USD 110.000 - 150.000; Tempo integral

Resumo da vaga

Indigo Beam Consulting in Monaca, United States, seeks an experienced OT Security Engineer to maintain and secure site OT assets (DCS, SIS, PLCs, HMIs) and support operations. The role is hands-on, run-and-maintain, reporting to the OT Engineer and asset custodians.

You will execute preventive and corrective maintenance, log work, manage permits, and coordinate with Operations, IT, OT Security, and vendors to ensure safe, reliable operations while adhering to site policies and MOC requirements.

Qualificações

• 5+ years of OT/industrial automation experience in continuous-process environments.
• Hands-on maintenance and troubleshooting of Windows-based OT assets, PLC/DCS, and industrial networks.
• Knowledge of risk-based maintenance, cybersecurity basics, patch and firmware lifecycle, and change control in OT.
• Ability to follow procedures, document work, and coordinate with multiple teams without disrupting production.
• Strong coordination and communication across Operations, IT, OT security and vendors.

Responsabilidades

• Plan and execute OT maintenance based on asset criticality and schedules.
• Log preventive, corrective, and cybersecurity work in maintenance tracking tools.
• Ensure permits and site access procedures are followed.
• Verify backups, patching per schedule, and vendor-approval constraints.
• Review firmware, network equipment, and implement vendor-approved updates.
• Inspect cabinets and racks for integrity and compliance.
• Coordinate changes under MOC and document handover notes.
• Escalate overdue tasks and manage outages or deferrals.

Conhecimentos

OT Security

Industrial Automation

Windows OT admin

Maintenance planning

Documentation & recordkeeping

Formação

Technical degree or equivalent in engineering/IT

Ferramentas

DeltaV

DeltaV SIS

Rockwell PLCs

Siemens control systems

OPC/Modbus

PI System

Descrição da vaga

Operational Technology (OT) Security Engineer

Monaca, United States

Indigo Beam Consulting provides a common-sense approach to solving business problems through technology.

Born out of Bluware Inc. which has been in business for twenty-seven years, Indigo Beam was conceived as a full-service business consulting company that deeply cares about creating technology solutions that are in harmony with the environments in which they exist.

We believe that for a technology solution to be sustainable, it must be congruent with the business processes it serves, indigenously maintainable, and cognizant of the unique traits of the organization which it calls home.

Job Description

Joining: Immediate

Our client is seeking an experienced Operational Technology (OT) Security contractor to keep site OT assets running safely, reliably, and securely. This is a hands-on run-and-maintain role.

Role Overview

• Scope: site OT assets in network Levels 1 to 3.5, including DCS, SIS, PLCs, HMIs, network infrastructure, backup and supporting systems.
• Focus: execute and document preventive and corrective maintenance across control, safety, server, endpoint, and network systems.
• Reports to: the assigned OT Engineer and asset custodians.
• Works with: Operations, PACO / Control Systems, OT Security, IT, maintenance teams, and system vendors.
• Standards: site risk-based OT Security Maintenance Policy, asset-specific plans, vendor requirements, permits, and Management of Change (MOC).
• Note: the contractor executes work but does not approve risk, changes, or vendor updates.

What You'll Do

1. Maintenance Planning & Records

   • Plan and execute assigned OT maintenance based on asset criticality, the maintenance schedule, the OT Asset Register, the Backup Plan, vendor guidance, and operating windows.
   • Log all preventive, corrective, and cybersecurity work in the OT Security SharePoint Maintenance Tracking Tool (asset ID and class, dates, task details, findings, and personnel).
   • Report incomplete or abnormal work and escalale overdue tasks to the Asset Custodian and the OT Security Site Process Focal Point (SPF).
   • When operating constraints block the work, help defer it to the next outage, document the reason, and apply temporary mitigations (enhanced monitoring, limiting changes or remote access, checking backup and failover readiness).
   • Obtain work permits, including Permit Vision questionnaires, and follow approved site access procedures.

2. Backups, Antivirus & Patching

   • Verify system and configuration backups per the OT Backup Plan, report failures, and support recovery checks.
   • Keep antivirus definitions current on Windows OT assets. Escalate when they are more than a week out of date and validate the alerting mechanism quarterly if no alerts occur.
   • Patching schedule:
   • Systems not affected by automatic restarts: quarterly
   • Systems with operational impact (after vendor approval): every 6 months for high and medium risk, annually for low risk
   • Before patching, confirm asset classification, vendor approval, operational impact, maintenance window, and MOC / permit. Never force restarts on process-control, safety, or continuous-production systems.

3. Firmware & Network Maintenance

   • Review switch and firewall firmware at least every 2 years, or sooner if a critical vulnerability is reported.
   • Check control-system and PLC firmware with vendors at least annually. Apply only vendor-approved changes (for Emerson systems, only Emerson-recommended updates and procedures).
   • When online updates are not feasible, defer to the next planned outage with documented risk acceptance and interim controls.
   • Review firewall rules to confirm they are documented, justified, and least-privilege, and remove obsolete rules through change management.

4. Physical Inspections

   • Inspect cabinets, panels, and racks for integrity, locking, water ingress, heat, and dust. Record issues and follow up.
   • Quarterly: CCB server-room cabinets, GTG control-system cabinets (PEEEC building), SKF magnetic-bearing PLCs, Bently Nevada BN3500 racks
   • Every 6 months: DeltaV field cabinets, STG control-system cabinets (PEEEC building), Woodward PLC cabinets, PSA cabinets (FAR #3), Prognost racks
   • Annually: Rockwell PLC cabinets, Additives control cabinets

5. Access, Cyber Defense & Spares

   • Review user, service, and privileged accounts quarterly and flag inactive, default, shared, or expired vendor accounts for removal.
   • Review OT cyber-defense reports monthly and route relevant events to the OT Security team.
   • Maintain the critical OT spares record (non-SAP) and review it annually for condition, readiness, and firmware compatibility.
   • Track spare usage and coordinate early with vendors on long-lead items.

6. Change Control & Troubleshooting

   • Troubleshoot OT hardware, software, network, backup, and endpoint issues, and tell operational faults apart from security events.
   • Make changes only under approved MOC, with testing, rollback, and documentation.
   • Coordinate impact assessments and maintenance windows with the Asset Custodian, PACO, Operations, OT Security, IT, and vendors.
   • Keep records and handover notes up to date and support outage and turnaround planning.

Requirements

• Relevant experience supporting OT, industrial automation, control systems, or industrial infrastructure in a continuous-process or similarly safety-critical operating environment; typically five or more years in a related role.
• Hands-on experience maintaining and troubleshooting Windows-based OT assets, PLC / DCS systems, industrial networks, and associated servers or applications.
• Working knowledge of risk-based maintenance, cybersecurity fundamentals, patch and firmware lifecycle practices, account access reviews, backups, and change control in OT environments.
• Demonstrated ability to execute permitted work safely, follow detailed procedures and vendor instructions, document work accurately, and escalale issues without disrupting production or safety functions.
• Strong coordination, written communication, troubleshooting, and recordkeeping skills across Operations, engineering, IT, OT security, maintenance, and external vendors.
• Relevant technical degree, associate degree, or equivalent combination of technical training and practical OT experience.
• Must meet applicable site access, work authorization, and contract-firm requirements.

Technology Environment

• Relevant experience with comparable systems is valuable; candidates are not expected to know every platform. The site environment includes Emerson DeltaV / DeltaV SIS; Rockwell PLCs; Siemens control systems; GE Mark VIe; Woodward; SKF magnetic-bearing PLCs; Bently Nevada 3500; Prognost; Windows OT servers and endpoints; virtualization; industrial firewalls and switches; OPC and Modbus; PI System; backup / recovery tools; SolarWinds; Nozomi; and endpoint-protection platforms.

Preferred Qualifications

• Experience in petrochemical, chemical manufacturing, refining, LNG, or another continuous-process industry.
• Experience supporting planned maintenance, turnarounds, commissioning, or outage execution in a live operating facility.
• Vendor training or experience with DeltaV, Rockwell, industrial networking / firewalls, OT virtualization, system backups, endpoint protection, or OT asset / threat monitoring.
• Familiarity with IEC 62443 concepts, OT asset inventories, SharePoint-based maintenance records, and permit / MOC workflows.

The contractor executes work assigned by the site OT Engineer / Asset Custodian and follows applicable site policies and vendor procedures. Approval of MOC, risk acceptance, access authorization, maintenance deferrals, and vendor-specific updates remains with the designated site authorities and / or required vendors. The contract firm should identify any proposed schedule, coverage, or mobilization details separately.