OT Cybersecurity Engineer / Analyst

About the Company:

We are supporting a U.S. energy company built on more than a decade of hands-on operating experience and a long-term ownership approach. It delivers energy infrastructure including solar, storage, and firm capacity solutions that provide dependable, affordable power, support local communities, and help meet America's rapidly growing electricity demand. The team has commercialized 850+ energy projects totaling 19.0GW. The company has 6.8GW of fleet ownership and operates and maintains 8.6GW across 28 states for its own fleet and third-party asset owners.

About the Role:

We are looking for an OT cybersecurity engineer/analyst to protect the SCADA and operational technology systems that monitor and control our generation sites. You will maintain OT systems by keeping them patched, protected from malware, monitored for intrusions, ensuring resiliency, and you will work with the SCADA team, IT, and vendors to do it without disrupting operations.

Key Responsibilities:

Patch and vulnerability management

• Track vendor advisories and vulnerabilities for OT assets, including SCADA servers, HMIs, historians, RTUs/PLCs, firewalls, switches, routers, and cellular gateways.
• Test and schedule patches with vendors and site teams. Document approvals, maintenance windows, rollback plans, and exceptions.
• Run vulnerability scans, prioritize findings by risk, and track remediation to closure.
• Report on patch compliance and open vulnerabilities across sites.

Antivirus and endpoint protection

• Deploy and manage antivirus and endpoint protection on OT-appropriate Windows and Linux hosts, including scan schedules and exclusions that will not disrupt control systems.
• Review detections, investigate suspicious activity, and remediate infected or at-risk systems.
• Manage removable media and transient asset controls for vendor and field laptops.

Network intrusion detection and incident response

• Monitor OT network traffic with intrusion detection and monitoring tools such as Dragos, Zeek, Snort, or similar, and tune rules to reduce false positives.
• Triage and investigate alerts in the SIEM, determine scope and impact, and escalate or contain as needed.
• Maintain and test incident response plans, including tabletop exercises with IT, operations, and vendors.
• Review firewall logs, VPN activity, and remote access for anomalies.

Vulnerability Assessments

• Plan and perform active vulnerability assessments of OT assets during approved maintenance windows, using validated scanning methods that minimize operational risk
• Conduct passive vulnerability assessments using network monitoring, asset discovery, configuration reviews, and available threat intelligence without disrupting control-system operations.
• Analyze and prioritize assessment findings based on exploitability, asset criticality, operational impact, and applicable OT cybersecurity requirements.
• Develop mitigation and remediation plans with asset owners, operations, IT/OT, and vendors; validate corrective actions and track findings through closure or documented risk acceptance.
• Coordinate with third-party assessors on external vulnerability assessments, including defining scope and rules of engagement, facilitating access, reviewing results, and managing follow-up actions.

Resiliency and disaster recovery

• Develop and maintain site-specific OT disaster recovery procedures, including system dependencies, restoration priorities, recovery time and recovery point objectives, and vendor contacts.
• Maintain and monitor secure backups of SCADA servers, HMIs, historians, controller programs, and network device configurations, including offline or immutable copies
• Perform scheduled backup restoration and disaster recovery exercises with operations, IT/OT, and vendors; document results, verify data integrity, and track corrective actions to closure.
• Assess OT systems for single points of failure, maintain redundancy and critical spares, and coordinate failover testing within approved maintenance windows.
• Coordinate safe restoration of OT services following outages or cyber incidents, validating system configurations, communications, and control functionality with operations before returning systems to service.

Compliance and collaboration

• Collect and maintain evidence for NERC CIP requirements covering patching, malware prevention, configuration baselines, vulnerability assessments, and incident response at CIP low and medium impact sites.
• Align controls with NIST 800-82 and NIST CSF, and support internal and third-party security assessments.
• Maintain asset inventories, network diagrams, and security documentation.
• Work with regional teams and third-party vendors on remote access, change control, and security requirements.

Required Qualifications

• 5+ years in cybersecurity, security operations, or OT/IT systems security.
• Hands-on experience with patch management and vulnerability scanning.
• Experience administering antivirus or endpoint protection tools and responding to detections.
• Working knowledge of network protocols and traffic analysis, including Wireshark and IDS/IPS tools.
• Experience with Windows and Linux system administration.
• Clear written and verbal communication, with the ability to work across technical and non-technical teams.

Preferred Qualifications

• Experience in ICS/SCADA or OT environments such as solar, wind, or utilities.
• Working knowledge of NERC CIP requirements and compliance evidence.
• Familiarity with OT protocols (DNP3, Modbus, IEC 61850) and OT monitoring platforms such as Dragos.
• Experience with the tools listed below, or comparable products.
• Preferred certifications: such as Security+, GICSP, GCIP, CISSP, or CEH.
• Scripting or automation experience (Python, PowerShell, Ansible).