OT Security Architect

Exp. Required: 10+ Year’s

Must Have Technical/Functional Skills

• Proven experience defining OT/ICS security architectures for manufacturing, engineering, research, laboratory, supply-chain, overhaul, repair, assembly, or test environments.

• Hands-on architecture experience for IT/OT network segmentation, zones and conduits, industrial DMZs, secure remote access, firewalls, switching, load balancing, and passive OT monitoring.

• Ability to lead site discovery, current-state assessment, architecture-gap analysis, target-state design, design reviews, implementation governance, validation, stabilization, and operational handover.

• Experience developing and approving High-Level Designs, Low-Level Designs, network and data-flow diagrams, bills of materials, security patterns, implementation roadmaps, technical standards, and architecture decision records.

• Strong knowledge of IEC 62443, NIST SP 800-82, Purdue-model concepts, Zero Trust principles, least privilege, defense in depth, and secure change practices for operational environments.

• Knowledge of OT assets and protocols, including PLCs, HMIs, SCADA, historians, engineering workstations, industrial servers, network appliances, and industrial communications.

• Architecture knowledge of Nozomi Guardian/CMC or similar OT visibility platforms, Check Point and Palo Alto firewalls, Cisco or industrial switching, Zscaler, CyberArk, Splunk, ServiceNow, and CMDB integrations.

• Experience assessing security impact and operational risk for live-environment changes, including availability, safety, production continuity, rollback, testing, outage, and maintenance-window considerations.

• Experience establishing architecture governance, conducting design assurance and peer reviews, managing technical risks and exceptions, and ensuring alignment with customer policies and approved reference architectures.

• Experience supporting build and managed-service teams across incidents, vulnerabilities, changes, lifecycle refresh, platform optimization, compliance, and continuous improvement.

• Working knowledge of ITAR/export-control requirements, CUI or EC environments, RBAC, segregation of duties, secure administration, and evidence requirements.

• Relevant certifications such as CISSP, GICSP, GRID, IEC 62443, TOGAF, SABSA, or vendor architecture certifications are preferred.

Roles & Responsibilities

• Own and govern the OT security architecture for Secure Connected Shops and related OT network services across assigned sites and delivery towers.

• Lead discovery and assessment of existing IT/OT networks, assets, security controls, connectivity, data flows, remote-access paths, operational dependencies, and architecture gaps.

• Define target-state OT security architecture and site patterns covering segmentation, zones and conduits, industrial DMZs, firewalls, switching, load balancing, secure remote access, monitoring, logging, and management connectivity.

• Create, review, approve, and maintain HLDs, LLDs, Visio network diagrams, data-flow diagrams, bills of materials, implementation timelines, architecture standards, design patterns, and configuration requirements.

• Ensure proposed designs and changes align with approved customer architectures, cybersecurity policies, implementation processes, ITAR/export-control boundaries, and applicable OT-security practices.

• Provide architecture oversight to network, OT, firewall, Nozomi, Zscaler, CyberArk, cloud, infrastructure, SOC, and site implementation teams throughout build and rollo ut.

• Review changes proposed for live OT environments and evaluate security, safety, availability, production, dependency, testing, rollback, and maintenance-window risks before implementation.

• Chair or support architecture and design reviews, document decisions, technical debt, risks, exceptions, assumptions, and dependencies, and drive remediation to closure.

• Validate implementation against the approved design through design assurance, configuration review, evidence checks, testing support, and as-built documentation review.

• Support incident, vulnerability, problem, and major-change investigations where architecture analysis or cross-domain technical leadership is required.

• Define reusable templates, playbooks, guardrails, standards, and reference patterns to enable consistent execution across global sites and delivery pods.

• Guide operational readiness, stabilization, knowledge transfer, SOP development, monitoring requirements, support-model definition, and handover to L1/L2/L3 operations.

• Collaborate with site IT/OT, engineering, facilities, maintenance, network, cybersecurity, compliance, business-validation, vendor, and governance stakeholders.

• Identify architecture optimization and continuous-improvement opportunities while preserving operational resilience, regulatory compliance, and production continuity.

Generic Managerial Skills, If any

Strong architecture leadership, stakeholder influence, workshop facilitation, technical writing, design governance, risk-based decision-making, and ability to translate complex OT security requirements into executable site designs and standards.