OT Senior Security Engineer (IT & OT Vulnerability Assessment)

Location: San Diego - Onsite Role Architecture, asset inventory and existing controls: Review the OT/IT architecture, network diagrams and data flows across the treatment plant, pump/lift stations, reservoirs and remote telemetry sites. Identify vulnerabilities, misconfigurations and security gaps across PLCs, SCADA systems, HMIs, servers, workstations, network devices and field assets. Review device hardening: default credentials, open services, insecure protocols, firmware versions and controller key-switch or mode settings. Network segmentation and boundary security Evaluate network segmentation, switches, routers and firewall rules against the Purdue model and IEC 62443 zones and conduits. Assess OT/IT boundary security, the DMZ design and any direct paths between the business network and control systems. Review inter-site communications (radio, cellular, fiber, MPLS/VPN links to remote stations) for encryption, segmentation and exposure. Remote, vendor and wireless access Review remote access, authentication and access management controls, including VPNs, jump hosts, MFA and privileged accounts. Assess vendor and integrator access: onboarding/offboarding, shared accounts, session monitoring and time-bound access. Identify wireless connectivity risks, rogue access points, cellular modems and unmanaged remote access tools. Lifecycle and patch management Identify unsupported and end-of-life assets (operating systems, PLC firmware, HMI software, network gear).Evaluate patch management practices and gaps, and recommend compensating controls where patching is not feasible. Governance and operational practices Evaluate change management, configuration management and backup/recovery practices for control system logic and configs. Review access control practices, including role-based access, account reviews and separation of duties. Reporting and roadmap Rate findings by risk, weighing likelihood against impact on public health, water quality and plant operations. Deliver a prioritized remediation roadmap with actionable recommendations, split into quick wins, medium-term and strategic items. Present results to plant operations, IT and utility leadership in both technical and executive formats.

Required qualifications: Bachelor's degree in Cybersecurity, Computer/Electrical Engineering, Information Technology or a related field, or equivalent experience.6+ years in cybersecurity, including at least 3 years hands-on with OT/ICS environments. Has run at least two OT security assessments end to end, from scoping through the final report. Hands-on knowledge of PLCs, RTUs, HMIs and SCADA platforms common in U.S. water utilities (for example Rockwell/Allen-Bradley, Schneider Electric, Siemens, GE, Inductive Automation Ignition, AVEVA/Wonderware).Strong networking skills: VLANs, routing, firewall rulebase review (Palo Alto, Fortinet, Cisco), VPNs and industrial switches. Familiar with IEC 62443, NIST SP 800-82 and the NIST Cybersecurity Framework. Strong report writing, with the ability to turn technical findings into a clear roadmap for executives. Preferred qualifications and certifications Experience in the water/wastewater sector, ideally including AWIA Section 1433 risk and resilience assessments or emergency response plans. Familiar with treatment processes (intake, filtration, chemical dosing, disinfection, distribution) and the safety impact of control failures. Experience with remote telemetry: licensed radio, cellular gateways and SCADA polling of lift and pump stations. Hands-on with OT monitoring platforms and assessment tooling (see Frameworks and tools).

Certifications: (one or more preferred):GIAC GICSP, GRID or GCIPISA/IEC 62443 Cybersecurity Expert or Risk Assessment Specialist