Lab / OT Security Systems Engineer

Role Details

• Title: Lab / OT Security Systems Engineer
• Location: San Diego, CA
• Duration: 6 months
• GBaMS ReqID: 10998694
• Experience Required: 6–8 years
• Primary Skill: ServiceNow IT Service Management
• Domain: Life Sciences / Biopharma / Laboratory & OT Security

Key Responsibilities

NAA (Non-Attributable Account) Remediation

• Support the design, testing, and execution of the Non-Attributable Account (NAA) remediation program.
• Support remediation across RC4-dependent and non-RC4-dependent account types.
• Build, maintain, and activate host allow/deny lists within the Lab Organizational Unit (OU) in Active Directory.
• Coordinate with InfoSec and Active Directory teams on password reset mechanisms.
• Validate password reset outcomes across pilot and full rollout phases.
• Engage Business System Owners and lab staff to:
  • Identify NAA usage patterns.
  • Confirm active engagements.
  • Support migration to properly managed service accounts.
• Support deployment and configuration of:
  • Transparent Screen Lock (TSL)
  • BeyondTrust
• Replace NAA-dependent workflows with secure account and access mechanisms.

Software Governance & Controls

• Assist in implementing policy-based software allowlists across lab workstations and instrument PCs.
• Identify unauthorized or unlicensed software installed on lab endpoints.
• Support remediation planning for unauthorized software.
• Develop and maintain a formal software exception request process.
• Support legitimate scientific software deployment requirements.

Vulnerability Management

• Support CrowdStrike EDR sensor deployment and gap remediation.
• Coordinate endpoint security activities with InfoSec and site teams.
• Identify and remediate open or misconfigured file shares.
• Address lateral movement and data exfiltration risks.
• Support OS patching activities and compliance tracking.
• Identify end-of-life operating systems.
• Develop remediation and isolation strategies for EOL systems.
• Support server-level vulnerability triage and remediation.

USB & Data Transfer Controls

• Assess USB usage patterns across laboratory sites and instrument workflows.
• Assist in implementing tiered USB restriction policies:
  • Block
  • Monitor
  • Allow by exception
• Ensure USB security controls do not disrupt legitimate scientific workflows.
• Manage formal USB exception processes for vendor access scenarios.

Cross-Site & Operational Support

• Provide hands-on technical support to global laboratory locations.
• Support sites across:
  • Boston / US
  • Oxford / UK
  • Other global laboratory locations
• Maintain accurate documentation of:
  • System configurations
  • Allow/deny lists
  • Service account inventories
  • Workstream progress
• Support demand intake and ServiceNow request management.
• Manage service account and access requests.
• Participate in hypercare following major security changes.
• Troubleshoot connectivity and authentication issues.
• Communicate effectively with:
  • Lab scientists
  • Business System Owners
  • Technical teams
  • Senior leadership

Required Qualifications

Education

• Bachelor’s degree in:
  • Computer Science
  • Information Technology
  • Cybersecurity
  • Related field
• Equivalent professional experience may be considered.

Experience

• 2–5 years of relevant experience in:
  • IT/OT Systems Engineering
  • Endpoint Security
  • Laboratory Systems Support
• Hands-on experience with Active Directory administration.
• Experience managing:
  • Organizational Units (OU)
  • Group Policy
  • Service accounts
• Experience supporting laboratory, manufacturing, or operational technology environments.
• Experience executing security remediation activities, including:
  • OS patching
  • Endpoint agent deployment
  • Access control changes
• Experience with endpoint security platforms, preferably CrowdStrike.
• Experience with privileged access management or password vault tools, preferably BeyondTrust.
• Familiarity with Endpoint Management (EPM) tools.

Identity & Access Management

• Strong Active Directory administration skills.
• Experience with:
  • OU structures
  • Group Policy Objects (GPOs)
  • User accounts
  • Service accounts
  • Authentication protocols
• Knowledge of:
  • RC4
  • NTLM
  • Kerberos
• Understanding of allow/deny list enforcement within AD and Lab OU environments.
• Experience with service account lifecycle management.
• Knowledge of privileged access controls.
• Understanding of enterprise Identity Management tools such as SailPoint.

Endpoint & OT Security

• Working knowledge of Endpoint Detection and Response (EDR) platforms.
• Experience with or knowledge of CrowdStrike Falcon.
• Understanding of OT/laboratory network architecture.
• Knowledge of:
  • Isolated lab networks
  • Semi-isolated lab network segments
  • Instrument connectivity
  • OT security risks
• Familiarity with Windows endpoint:
  • USB restriction policies
  • Software control policies
• Knowledge of vulnerability management, including:
  • OS patching
  • EOL systems
  • Open file shares
  • Network-level exposure

Lab & Instrument Environment

• Understanding of how laboratory instruments authenticate to networks.
• Knowledge of dependencies between shared accounts and instrument operation.
• Familiarity with Transparent Screen Lock (TSL) or similar technologies.
• Awareness of laboratory data systems such as:
  • NuGenesis (SDMS)
  • Empower (Waters)
  • Scientific data platforms
  • Chromatography platforms
• Experience or awareness of Biopharma laboratory environments.
• Understanding of GxP and Information Security compliance requirements.
• Familiarity with ITIL / ITSM principles.

Tools & Platforms

• ServiceNow or equivalent ITSM platform.
• BeyondTrust or equivalent PAM/remote support tools.
• Microsoft Windows Server.
• Windows 10/11 administration.
• Network monitoring and log analysis tools.
• PowerShell proficiency preferred.
• CrowdStrike Falcon / EDR.
• Active Directory.
• SailPoint.

Soft Skills

• Strong analytical and problem-solving skills.
• Excellent attention to detail.
• Ability to analyze large datasets, including:
  • Login logs
  • AD exports
  • Host inventories
• Strong written and verbal communication skills.
• Ability to explain technical concepts to non-technical lab personnel.
• Strong organizational and execution skills.
• Ability to manage multiple concurrent workstreams and deadlines.
• Comfortable working in fast-moving and ambiguous environments.
• Ability to adapt to changing security priorities.
• Collaborative and service-oriented mindset.
• Strong stakeholder management skills.

Other Requirements

• Ability to work across global, multi-site laboratory organizations.
• Ability to collaborate with US and UK laboratory teams.
• Willingness to participate in hypercare periods.
• Ability to provide out-of-hours support during major change activations when required.
• Ability to build trust with:
  • Technical teams
  • Lab scientists
  • Business stakeholders
  • Science stakeholders
• Experience in regulated environments such as life sciences or pharmaceuticals is preferred.

Key Skills / Keywords

• ServiceNow ITSM
• Active Directory
• AD / OU / GPO
• Service Accounts
• RC4 / NTLM / Kerberos
• SailPoint
• CrowdStrike Falcon
• EDR
• BeyondTrust
• PAM
• Endpoint Security
• Endpoint Management
• OT Security
• Laboratory Security
• Lab Systems
• Biopharma
• GxP
• ITIL
• ITSM
• Windows Server
• Windows 10/11
• PowerShell
• Vulnerability Management
• OS Patching
• USB Security
• Software Allowlisting
• Network Isolation
• Transparent Screen Lock
• NuGenesis
• Empower
• ServiceNow Ticket Management
• Life Sciences
• Pharmaceutical / Biopharma
• Critical Laboratory Infrastructure