Senior OT Security Architect: Secure Connected Shops

Tata Consultancy Services; Cincinnati (OH); On-site; USD 120,000 - 140,000; Full time

Benefits offered by this job

Discretionary Incentive

Medical Coverage

Dental & Vision

Parental Leaves

401K Plan

Certification & Training Reimbursement

Vacation & Holidays

Legal & Financial Assistance

Job summary

Tata Consultancy Services is seeking an OT Security Architect to define and govern OT/ICS security architectures across manufacturing, engineering, and other OT environments. You will lead site discovery, target-state design, and reviews, while ensuring alignment with IEC 62443, NIST SP 800-82, and Purdue‑model concepts.

Responsibilities include designing secure architectures, validating implementations, and guiding cross-functional teams through rollouts and governance.

Qualifications

• Proven experience defining OT/ICS security architectures for manufacturing, engineering, research, laboratory, supply-chain, overhaul, repair, assembly, or test environments.
• Hands-on architecture experience for IT/OT network segmentation, zones and conduits, industrial DMZs, secure remote access, firewalls, switching, load balancing, and passive OT monitoring.
• Ability to lead site discovery, current-state assessment, architecture-gap analysis, target-state design, design reviews, implementation governance, validation, stabilization, and operational handover.
• Experience developing and approving High-Level Designs, Low-Level Designs, network and data-flow diagrams, bills of materials, security patterns, implementation roadmaps, technical standards, and architecture decision records.
• Strong knowledge of IEC 62443, NIST SP 800-82, Purdue-model concepts, Zero Trust principles, least privilege, defense in depth, and secure change practices for operational environments.
• Knowledge of OT assets and protocols, including PLCs, HMIs, SCADA, historians, engineering workstations, industrial servers, network appliances, and industrial communications.
• Architecture knowledge of Nozomi Guardian/CMC or similar OT visibility platforms, Check Point and Palo Alto firewalls, Cisco or industrial switching, Zscaler, CyberArk, Splunk, ServiceNow, and CMDB integrations.
• Experience assessing security impact and operational risk for live-environment changes, including availability, safety, production continuity, rollback, testing, outage, and maintenance-window considerations.
• Experience establishing architecture governance, conducting design assurance and peer reviews, managing technical risks and exceptions, and ensuring alignment with customer policies and approved reference architectures.
• Experience supporting build and managed-service teams across incidents, vulnerabilities, changes, lifecycle refresh, platform optimization, compliance, and continuous improvement.
• Working knowledge of ITAR/export-control requirements, CUI or EC environments, RBAC, segregation of duties, secure administration, and evidence requirements.
• Relevant certifications such as CISSP, GICSP, GRID, IEC 62443, TOGAF, SABSA, or vendor architecture certifications are preferred.
• Own and govern the OT security architecture for Secure Connected Shops and related OT network services across assigned sites and delivery towers.
• Lead discovery and assessment of existing IT/OT networks, assets, security controls, connectivity, data flows, remote-access paths, operational dependencies, and architecture gaps.
• Define target-state OT security architecture and site patterns covering segmentation, zones and conduits, industrial DMZs, firewalls, switching, load balancing, secure remote access, monitoring, logging, and management connectivity.
• Create, review, approve, and maintain HLDs, LLDs, Visio network diagrams, data-flow diagrams, bills of materials, implementation timelines, architecture standards, design patterns, and configuration requirements.
• Ensure proposed designs and changes align with approved customer architectures, cybersecurity policies, implementation processes, ITAR/export-control boundaries, and applicable OT-security practices.
• Provide architecture oversight to network, OT, firewall, Nozomi, Zscaler, CyberArk, cloud, infrastructure, SOC, and site implementation teams throughout build and roll-out.
• Review changes proposed for live OT environments and evaluate security, safety, availability, production, dependency, testing, rollback, and maintenance-window risks before implementation.
• Chair or support architecture and design reviews, document decisions, technical debt, risks, exceptions, assumptions, and dependencies, and drive remediation to closure.
• Validate implementation against the approved design through design assurance, configuration review, evidence checks, testing support, and as-built documentation review.
• Support incident, vulnerability, problem, and major-change investigations where architecture analysis or cross-domain technical leadership is required.
• Define reusable templates, playbooks, guardrails, standards, and reference patterns to enable consistent execution across global sites and delivery pods.
• Guide operational readiness, stabilization, knowledge transfer, SOP development, monitoring requirements, support-model definition, and handover to L1/L2/L3 operations.
• Collaborate with site IT/OT, engineering, facilities, maintenance, network, cybersecurity, compliance, business-validation, vendor, and governance stakeholders.
• Identify architecture optimization and continuous-improvement opportunities while preserving operational resilience, regulatory compliance, and production continuity.

Responsibilities

• Own and govern the OT security architecture for Secure Connected Shops and related OT network services across assigned sites and delivery towers.
• Lead discovery and assessment of existing IT/OT networks, assets, security controls, connectivity, data flows, remote-access paths, operational dependencies, and architecture gaps.
• Define target-state OT security architecture and site patterns covering segmentation, zones and conduits, industrial DMZs, firewalls, switching, load balancing, secure remote access, monitoring, logging, and management connectivity.
• Create, review, approve, and maintain HLDs, LLDs, Visio network diagrams, data-flow diagrams, bills of materials, implementation timelines, architecture standards, design patterns, and configuration requirements.
• Ensure proposed designs and changes align with approved customer architectures, cybersecurity policies, implementation processes, ITAR/export-control boundaries, and applicable OT-security practices.
• Provide architecture oversight to network, OT, firewall, Nozomi, Zscaler, CyberArk, cloud, infrastructure, SOC, and site implementation teams throughout build and rollout.
• Review changes proposed for live OT environments and evaluate security, safety, availability, production, dependency, testing, rollback, and maintenance-window risks before implementation.
• Chair or support architecture and design reviews, document decisions, technical debt, risks, exceptions, assumptions, and dependencies, and drive remediation to closure.
• Validate implementation against the approved design through design assurance, configuration review, evidence checks, testing support, and as-built documentation review.
• Support incident, vulnerability, problem, and major-change investigations where architecture analysis or cross-domain technical leadership is required.

Skills

OT/ICS security architectures

IT/OT network segmentation

Zero Trust principles

IEC 62443 knowledge

NIST SP 800-82 knowledge

Purdue-model concepts

Security architecture governance

Threat and risk assessment

OT assets & protocols

OT visibility platforms (Nozomi/CMC)

Education

Bachelor of Computer Science

Tools

Nozomi Guardian/CMC

Check Point

Palo Alto

Cisco switching

Zscaler

CyberArk

Splunk

ServiceNow

CMDB integrations

Job description

Tata Consultancy Services is seeking an OT Security Architect to define and govern OT/ICS security architectures across manufacturing, engineering, and other OT environments. You will lead site discovery, target-state design, and reviews, while ensuring alignment with IEC 62443, NIST SP 800-82, and Purdue‑model concepts.

Responsibilities include designing secure architectures, validating implementations, and guiding cross-functional teams through rollouts and governance.