Senior Consultant Senior Manager, Cyber Operate

Design OT security Define the OT security architecture and reference designs: Purdue-model zoning, IEC 62443 zones and conduits, OT DMZs, secure remote access, and backup and recovery Set cybersecurity requirements for OEMs, system integrators and contractors (IEC 62443-2-4, 3-3, 4-2), and review their designs before installation Secure new builds through to handover: check that systems are delivered hardened, documented, and with default credentials and unused services removed Define secure IT/OT integration patterns for systems that share data with business and smart-city platforms Assess OT environments Build and maintain the OT asset inventory: controllers, HMIs, servers, network devices and their communication paths Run IEC 62443 risk assessments: identify zones, set target security levels, assess gaps and recommend controls Assess compliance with NCA OTCC and NCA ECC for OT systems, and track remediation Test OT and connected IT environments Configuration reviews: review the security configuration of PLCs, HMIs, engineering workstations, SCADA and historian servers, industrial switches and firewalls against vendor hardening guides and approved baselines Firewall and segmentation testing: review firewall rule sets at IT/OT and zone boundaries, and test that segmentation actually blocks unauthorized paths between corporate IT, the OT DMZ and control networks Network traffic analysis: capture and analyze OT network traffic (e.g. Wireshark, Zeek, OT monitoring platforms) to baseline normal communications, find unknown assets, insecure protocols, cleartext credentials and unexpected external connections Connected IT systems: test the Windows and Linux servers, domain controllers, jump hosts and remote access gateways that support OT, covering patching, hardening, accounts and privileges Remote and wireless access: test vendor remote access paths, VPNs and industrial wireless for weak authentication and exposure Run safe, passive or approved active testing only, with change approval and operations sign-off, so live processes are never disrupted Produce clear test reports with risk-rated findings, evidence and practical fixes that suit the operational environment Manage OT security operations Deploy and manage OT network monitoring (e.g. Nozomi, Claroty, Dragos), and tune detections for industrial protocols (Modbus, BACnet, DNP3, IEC 61850) Build OT incident response playbooks with the SOC and operations teams, and run joint exercises Manage OT vulnerabilities and patching in line with vendor support and plant safety requirements Control and monitor third-party and vendor remote access to OT systems Govern and report Write OT security policies, standards and procedures aligned with NCA OTCC and IEC 62443 Work closely with operations and engineering teams on live sites, explaining security in operational terms and respecting safety and uptime Report OT risk posture and compliance status to management Leadership Capabilities: Builds own understanding of our purpose and values; explores opportunities for impact. Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. Understands expectations and demonstrates personal accountability for keeping performance on track. Actively focuses on developing effective communication and relationship-building skills. Understands how their daily work contributes to the priorities of the team and the business. Qualifications: Years of experience: 5-10 total years Bachelor's in electrical, control, computer engineering or a related field Hands-on experience with OT/ICS environments: PLCs, DCS, SCADA, BMS, HMIs and industrial networks Working knowledge of industrial protocols (e.g. Modbus, BACnet, DNP3, OPC UA, IEC 61850) Practical experience applying IEC 62443 and NCA OTCC Hands-on technical testing in OT or converged IT/OT environments: configuration reviews, firewall rule reviews and segmentation testing Network traffic capture and analysis skills (e.g. Wireshark, Zeek), including industrial protocols Experience with at least one OT monitoring platform (Nozomi, Claroty, Dragos or similar) Comfortable working on live operational sites under safety rules Experience with building management, district cooling, utilities, ride or show control, or smart-city IoT is preferred. Experience securing new-build projects through construction and handover is preferred. Windows/Active Directory hardening and testing in OT environments is preferred. Network engineering skills (industrial firewalls, segmentation, data diodes) is preferred. Arabic Language is preferred. At least one preferred: GICSP, GRID, ISA/IEC 62443 Cybersecurity Expert/Specialist . Also valued: CISSP, GCIP, GPEN, vendor certifications (Nozomi, Claroty, Dragos). Frameworks & Standards: NCA OTCC-1:2022 NCA ECC-2:2024 IEC , 2-4, 3-2, 3-3, 4-2) NIST SP 800-82 Rev 3 NIST SP 800-53 Rev 5 NIST CSF 2.0 MITRE ATT&CK for ICS Years of experience: 5-10 total years Bachelor's in electrical, control, computer engineering or a related field Hands-on experience with OT/ICS environments: PLCs, DCS, SCADA, BMS, HMIs and industrial networks Working knowledge of industrial protocols (e.g. Modbus, BACnet, DNP3, OPC UA, IEC 61850) Practical experience applying IEC 62443 and NCA OTCC Hands-on technical testing in OT or converged IT/OT environments: configuration reviews, firewall rule reviews and segmentation testing Network traffic capture and analysis skills (e.g. Wireshark, Zeek), including industrial protocols Experience with at least one OT monitoring platform (Nozomi, Claroty, Dragos or similar) Comfortable working on live operational sites under safety rules Experience with building management, district cooling, utilities, ride or show control, or smart-city IoT is preferred. Experience securing new-build projects through construction and handover is preferred. Windows/Active Directory hardening and testing in OT environments is preferred. Network engineering skills (industrial firewalls, segmentation, data diodes) is preferred. Arabic Language is preferred. At least one preferred: GICSP, GRID, ISA/IEC 62443 Cybersecurity Expert/Specialist . Also valued: CISSP, GCIP, GPEN, vendor certifications (Nozomi, Claroty, Dragos).