OT Cybersecurity Analyst

CTS-Complete Technical Services, Inc.; Corpus Christi (TX); On-site; USD 120,000 - 170,000; Full time

Job summary

CTS-Complete Technical Services, Inc. is seeking an OT Cybersecurity Analyst to lead deployment and sustainment of cybersecurity platforms across the Corpus Christi refinery.

You will define monitoring, investigate alerts, and support incident response while coordinating with Automation, Operations, IT, and Corporate Cybersecurity. Ideal candidates have 5–10 years in ICS/OT security, hands-on experience with OT platforms, and familiarity with ISA/IEC 62443 as well as NIST guidance.

Qualifications

• 5-10 years in ICS, automation, OT networking, or OT cybersecurity with 3+ years in OT/ICS cybersecurity.
• Direct experience in refining, petrochemical, chemical, power generation, or similar continuous-process operations.
• Knowledge of DCS, PLC, SIS architectures and industrial protocols (e.g., Modbus, OPC/UA, EtherNet/IP).
• Hands-on with at least one OT network monitoring or asset visibility platform (Nozomi, Claroty, Dragos, etc.).
• Understanding of Purdue model, network segmentation, firewalls, DMZs, switches, and Windows AD in OT.
• Familiarity with ISA/IEC 62443, NIST CSF, and NIST SP 800-82.
• Valid TWIC card at start.
• Ability to work on-site in a refinery and communicate with operators, engineers, and IT.

Responsibilities

• Lead deployment, commissioning, and integration of OT cybersecurity platforms (Nozomi, SolarWinds, XONA, Octave/Hexagon Integrity, Axway).
• Define monitoring strategy, alerts, baselines, and escalation paths for OT networks and assets.
• Investigate alerts, correlate across platforms, and distinguish threats from normal process behavior.
• Support OT Cyber Incident Response Plan triage, evidence preservation, containment recommendations, and lessons learned.
• Perform security architecture reviews and risk assessments of DCS, PLC, SIS, historian, and network infrastructure.
• Support asset inventory, vulnerability, and patch risk for Honeywell Experion/TPS, Emerson DeltaV, Rockwell, Triconex.
• Develop and maintain procedures, standards, runbooks, and Management of Change for cybersecurity modifications.
• Coordinate with Corporate Cybersecurity on SIEM/log integration, threat intel, and enterprise standards.
• Train and mentor Automation staff and OT Cybersecurity Technician on platform use and procedures.
• Report program status, metrics, and risks to the Automation Manager.

Skills

OT cybersecurity

Industrial control systems

Communication with operators/IT

Education

Bachelor's degree in Engineering, Computer Science, Information Security, or related field

Tools

Nozomi

Claroty

Dragos

Industrial Defender

Tenable OT

Honeywell Experion/TPS

Emerson DeltaV

Job description

The OT Cybersecurity Analyst supports the Corpus Christi Automation Department in deploying, integrating, and sustaining OT cybersecurity capabilities across the refinery's control systems. The role leads technical execution of platform deployments, develops monitoring and response workflows, supports incident response, and helps build the procedures and training needed for long-term sustainment. The Analyst works closely with Automation, Operations, IT, and Corporate Cybersecurity and supports the site's role in the company's OT Cybersecurity program.

Key Responsibilities:

• Lead technical deployment, commissioning, and integration of OT cybersecurity platforms, including Nozomi (passive detection, vulnerability identification, threat intelligence), SolarWinds (network management), XONA (secure remote access), Octave/Hexagon Integrity (asset inventory and configuration management), and secure file transfer (Axway).
• Define monitoring strategy, alert tuning, baselines, and escalation paths for OT networks and control system assets.
• Investigate and analyze alerts and anomalies; correlate across platforms to separate genuine threats from false positives and normal process behavior.
• Serve in OT Cyber Support and OT Network Support roles under the OT Cyber Incident Response Plan (OT CIRP), including triage, evidence preservation, containment recommendations, and lessons learned.
• Perform security architecture reviews and risk assessments of DCS, PLC, SIS, historian, and network infrastructure consistent with ISA/IEC 62443 and NIST guidance.
• Support asset inventory, vulnerability, and patch-risk assessment for Honeywell (Experion/TPS), Emerson DeltaV, Rockwell, Triconex, and associated servers and workstations.
• Develop and maintain procedures, standards, runbooks, and documentation; support Management of Change for cybersecurity-related modifications.
• Coordinate with Corporate Cybersecurity on SIEM/log integration, threat intelligence, and enterprise standards.
• Train and mentor Automation staff and the OT Cybersecurity Technician on platform use and procedures.
• Report program status, metrics, and risks to the Automation Manager.

Required Qualifications:

• 5-10 years of experience in industrial control systems, automation, OT networking, or OT cybersecurity, with at least 3 years focused on OT/ICS cybersecurity.
• Direct experience in refining, petrochemical, chemical, power generation, oil & gas, or similar continuous-process industrial operations.
• Working knowledge of DCS, PLC, and SIS architectures and industrial protocols (e.g., Modbus, OPC/OPC UA, EtherNet/IP).
• Hands-on experience deploying or administering at least one OT network monitoring or asset visibility platform (e.g., Nozomi, Claroty, Dragos, Industrial Defender, Tenable OT).
• Understanding of network segmentation, Purdue model, firewalls, DMZs, switches, and Windows server/Active Directory in OT environments.
• Familiarity with ISA/IEC 62443, NIST CSF, and NIST SP 800-82.
• Valid TWIC (Transportation Worker Identification Credential) card at time of start.
• Ability to work safely on-site in an operating refinery and communicate clearly with operators, engineers, and IT.

Preferred Qualifications:

• Bachelor's degree in Engineering, Computer Science, Information Security, or related field (equivalent experience accepted).
• Certifications such as GICSP, GRID, ISA/IEC 62443 Cybersecurity Expert/Specialist, CISSP, or Security+.
• Experience with Honeywell Experion/TPS and/or Emerson DeltaV.
• Experience with Nozomi, SolarWinds, XONA, Axway, or PAS/Hexagon Integrity.
• Experience supporting incident response, tabletop exercises, or regulated security programs (e.g., TSA, USCG MTSA).
• Work is performed at an operating petroleum refinery. Candidates must follow company safety, PPE, permitting, and Management of Change requirements and be able to work in operating units, control rooms, and equipment rooms.
• This is a 100% on-site position at the Corpus Christi Refinery. Remote or hybrid work is not available.
• Candidates must pass company and contractor-agency background, drug, and safety screening.
• Normal schedule is day shift, Monday-Friday, with occasional after-hours or call-out support during incidents, outages, and turnarounds