Senior IT/OT Cybersecurity Risk Assessor

Salary: $192,400 - 192,400 per year Requirements:

• We are looking for at least seven years of broad experience in cybersecurity, information risk, security engineering, infrastructure, industrial cybersecurity, or a closely related field.
• We require at least five years of direct experience performing technical cybersecurity assessments, architecture reviews, control testing, vulnerability assessments, or formal risk analysis.
• We need experience working across enterprise IT and OT, ICS, industrial, manufacturing, transportation, utility, energy, facilities, or other cyber-physical environments.
• We expect strong knowledge of TCP/IP networking, routing, switching, firewalls, network segmentation, VPNs, wireless technologies, remote access, and standard network services.
• We look for practical knowledge of industrial architectures and protocols such as Modbus, DNP3, BACnet, OPC/OPC UA, EtherNet/IP, PROFINET, or similar technologies.
• We require technical familiarity with Windows and Linux systems, Active Directory or Entra ID, endpoint security, virtualization, cloud platforms, authentication, privileged access, logging, and vulnerability management.
• We need the ability to interpret network diagrams, system architectures, data flows, configurations, logs, packet captures, scan results, asset inventories, and other technical evidence.
• We value experience evaluating compensating controls for systems that cannot be patched, scanned, reconfigured, or interrupted using standard IT security practices.
• We need an understanding of how cybersecurity decisions can affect safety, process integrity, equipment reliability, operational availability, and business continuity.
• We expect experience applying recognized cybersecurity and risk frameworks in real-world assessments.
• We require the ability to work independently, manage multiple priorities, and deliver high-quality work within established deadlines.
• We need availability to attend client meetings and respond during agreed business hours.
• We require the ability to travel to client and operational sites when needed.
• A bachelors degree in cybersecurity, information systems, engineering, computer science, or a related discipline is preferred, or equivalent professional experience.
• Experience in manufacturing, transportation, utilities, energy, water, building automation, critical infrastructure, or regulated environments is preferred.
• Experience assessing cloud-connected industrial systems, IIoT devices, edge computing, telemetry platforms, or vendor-managed operational technology is preferred.
• Familiarity with Purdue Enterprise Reference Architecture, ISA-95, MITRE ATT&CK for ICS, cyber-informed engineering, and consequence-driven risk analysis is preferred.
• Experience with passive OT discovery, packet analysis, vulnerability-management platforms, network-monitoring tools, cloud-security platforms, and configuration-assessment technologies is preferred.
• Experience assessing Microsoft 365, Azure, AWS, firewalls, endpoint controls, and hybrid enterprise environments is preferred.
• Knowledge of safety instrumented systems, functional safety, high-availability architectures, disaster recovery, and operational resilience is preferred.
• Relevant certifications such as GICSP, GRID, GCIA, CISSP, CISM, CRISC, CISA, Security+, ISA/IEC 62443, or comparable credentials are preferred.

• We will have the selected contractor plan and conduct cybersecurity risk, control, architecture, and technical security assessments across IT and OT environments as part of a Risk and Control Assessment project team.
• We will ask the role to assess industrial control systems, SCADA platforms, distributed control systems, programmable logic controllers, remote terminal units, human-machine interfaces, historians, engineering workstations, industrial networks, field devices, building systems, and connected infrastructure.
• We will rely on this person to evaluate enterprise technologies, including networks, cloud platforms, identity systems, endpoints, servers, applications, databases, remote-access solutions, and security tools.
• We will need the role to review network architecture, segmentation, trust boundaries, data flows, remote connectivity, administrative pathways, vendor access, and dependencies between IT and OT systems.
• We expect the assessor to conduct technical and operational discovery sessions with system owners, engineers, operators, administrators, security personnel, vendors, and business leaders.
• We will have them evaluate controls related to identity and access management, privileged access, endpoint protection, network security, monitoring, vulnerability management, patching, configuration management, backups, incident response, resilience, and third-party access.
• We need the contractor to safely perform or support asset discovery, configuration analysis, vulnerability review, network traffic inspection, and technical evidence collection.
• We expect the assessor to recognize where conventional IT assessment techniques could introduce safety, reliability, availability, or production risks in operational environments.
• We will need them to identify credible threat scenarios, attack paths, control failures, and operational consequences.
• We expect the role to distinguish technical vulnerabilities from material risks by considering exposure, exploitability, threat capability, existing safeguards, operational dependencies, business impact, safety implications, and recovery requirements.
• We will have them test control design and operating effectiveness through interviews, observation, inspection, evidence review, configuration validation, and appropriately authorized technical procedures.
• We expect the contractor to produce assessment reports, risk registers, control-gap analyses, maturity assessments, remediation roadmaps, executive summaries, and client presentations.
• We will rely on them to support clients in developing practical corrective-action and risk-treatment plans.
• We expect the role to contribute to the ongoing improvement of our assessment methods, templates, technical procedures, and service offerings.

• AWS
• Active Directory
• Azure
• Cloud
• Ethernet
• Support
• Linux
• Microsoft 365
• Network
• Profinet
• Project Manager
• Security
• TCP/IP
• Windows
• Office 365

More:

We are seeking an experienced Senior IT/OT Cybersecurity Risk Assessor for an initial independent contractor engagement, with the potential for future full-time employment based on performance, business demand, and mutual fit. This is a senior, client-facing role that works across enterprise information technology, operational technology, industrial control systems, and cyber-physical environments. The position is remote, with designated onsite travel required as needed, and anticipated travel of approximately one to four weeks annually. The initial term is three months, with expected availability on Tuesdays and Thursdays from 9:00 a.m. to 5:00 p.m. Eastern Time, including internal and client meetings within that window. We offer a flexible schedule, and this role reports directly to the Project Manager with indirect accountability to the CEO. Compensation is based on the candidates stated requirements, with pay from $92.50 per hour and expected hours of 10 to 30 per week. Applications should include a current résumé, a summary of a personally conducted IT/OT or industrial cybersecurity assessment, details of responsibilities, methods and tools used, along with availability, location, travel flexibility, and requested hourly rate.

last updated 38 week of 2026