Operational Technology Security

Our client is seeking an experienced Operational Technology (OT) Security contractor to keep site OT assets running safely, reliably, and securely. This is a hands-on run-and-maintain role.

Role Overview

·Scope:site OT assets in network Levels 1 to 3.5, including DCS, SIS, PLCs, HMIs, network infrastructure, backup and supporting systems.

·Focus:execute and document preventive and corrective maintenance across control, safety, server, endpoint, and network systems.

·Reports to:the assigned OT Engineer and asset custodians.

·Works with:Operations, PACO / Control Systems, OT Security, IT, maintenance teams, and system vendors.

·Standards:site risk-based OT Security Maintenance Policy, asset-specific plans, vendor requirements, permits, and Management of Change (MOC).

·Note:the contractor executes work but does not approve risk, changes, or vendor updates.

What You'll Do

1. Maintenance Planning & Records

·Plan and execute assigned OT maintenance based on asset criticality, the maintenance schedule, the OT Asset Register, the Backup Plan, vendor guidance, and operating windows.

·Log all preventive, corrective, and cybersecurity work in the OT Security SharePoint Maintenance Tracking Tool (asset ID and class, dates, task details, findings, and personnel).

·Report incomplete or abnormal work and escalate overdue tasks to the Asset Custodian and the OT Security Site Process Focal Point (SPF).

·When operating constraints block the work, help defer it to the next outage, document the reason, and apply temporary mitigations (enhanced monitoring, limiting changes or remote access, checking backup and failover readiness).

·Obtain work permits, including Permit Vision questionnaires, and follow approved site access procedures.

2. Backups, Antivirus & Patching

·Verify system and configuration backups per the OT Backup Plan, report failures, and support recovery checks.

·Keep antivirus definitions current on Windows OT assets. Escalate when they are more than a week out of date and validate the alerting mechanism quarterly if no alerts occur.

·Patching schedule:

oSystems not affected by automatic restarts: quarterly

oSystems with operational impact (after vendor approval): every 6 months for high and medium risk, annually for low risk

·Before patching, confirm asset classification, vendor approval, operational impact, maintenance window, and MOC / permit. Never force restarts on process-control, safety, or continuous-production systems.

3. Firmware & Network Maintenance

·Review switch and firewall firmware at least every 2 years, or sooner if a critical vulnerability is reported.

·Check control-system and PLC firmware with vendors at least annually. Apply only vendor-approved changes (for Emerson systems, only Emerson-recommended updates and procedures).

·When online updates are not feasible, defer to the next planned outage with documented risk acceptance and interim controls.

·Review firewall rules to confirm they are documented, justified, and least-privilege, and remove obsolete rules through change management.

4. Physical Inspections