OT Cybersecurity Governance & Architecture Engineer

St. Florida City, FL
Jensen Beach, FL
Two Rivers, WI
Seabrook, NH
Palo, IA
Duration:6 Months
Experience:6-8Years
Job description:
We are seeking an OT-focused cybersecurity professional to strengthen our nuclear plant's cyber governance, architecture, and compliance posture. This role emphasizes design oversight, documentation, compliance, and coordination across Operations, Engineering, Maintenance, and IT. You will not be expected to perform routine hands-on work on plant control systems; instead, you will develop and maintain the documentation, requirements, and oversight needed to ensure digital systems meet regulatory, safety, and security objectives.

Key Responsibilities
Governance, Compliance, and Documentation
Maintain and continuously improve the plant Cyber Security Plan (CSP) implementation evidence, procedures, and records in accordance with 10 CFR 73.54 and NRC Regulatory Guide 5.71 (as implemented by the site license basis).
Author, review, and maintain cybersecurity procedures, standards, and work instructions aligned to the site QA program (10 CFR 50 Appendix B), document control, and records retention requirements.
Prepare for and support audits/inspections (e.g., NRC, internal QA, INPO/WANO), including collecting objective evidence, creating audit packages, tracking findings, and closing corrective actions through the CAP.
Lead and document periodic cyber control effectiveness reviews, self-assessments, and program health reports.
Architecture and Design Oversight
Define and maintain OT network security architecture artifacts: network and data-flow diagrams (Purdue model levels), segmentation and zoning, trust boundaries, system interconnections, and control system interfaces.
Develop and maintain baseline configurations and hardening standards for firewalls, switches/routers, jump hosts, unidirectional gateways/data diodes, and OT endpoints (in partnership with system owners).
Review and document firewall/VPN rulesets and change requests, ensuring least privilege, justification, and traceability to approved requirements.
Provide cybersecurity requirements and design input for plant modifications and digital upgrades (design change packages), including security controls, vendor remote access constraints, and monitoring requirements.
Oversee secure remote access and portable/removable media control programs, including procedures, approvals, and logging requirements.
Risk, Vulnerability, and Patch Management
Coordinate cyber risk assessments for OT assets and planned changes; document threat scenarios, control selection/rationale, and residual risk acceptance per plant processes.
Manage the intake and evaluation of vendor advisories and vulnerabilities; develop risk-informed compensating measures and patching strategies in coordination with Engineering and Operations.
Maintain a high-fidelity OT asset inventory with attributes (role, criticality, OS/firmware, comms, ports/services, interconnections), and ensure alignment with network diagrams and CSP records.
Monitoring, Incident Response, and Testing
Define monitoring and logging requirements for OT networks and assets; coordinate with IT/SOC teams to ensure appropriate visibility while respecting plant operational constraints.
Develop and maintain incident response playbooks, roles and responsibilities, and call-out procedures specific to OT environments; coordinate tabletop exercises and lessons-learned documentation.
Plan and document testing/validation approaches for cybersecurity controls (e.g., firewall rule reviews, backup/restore drills, access reviews) in a manner safe for plant operations.
Stakeholder Engagement and Training
Serve as the primary liaison between Cybersecurity and Operations/Engineering for OT matters; translate operational needs into clear, testable security requirements.
Provide targeted awareness and procedure-based training for plant staff, contractors, and vendors on cyber responsibilities (e.g., portable media, remote access, change control).
Participate in Work Management and configuration control processes (MOC/design change), ensuring cybersecurity impacts are identified, documented, and reviewed.
Documentation Deliverables You Will Own or Coordinate
CSP implementation procedures and control matrices
OT network and data-flow diagrams; boundary and zoning documents
Firewall/VPN rulesets with rule-by-rule justification and review records
OT asset inventory and configuration baselines
Risk assessments and cyber technical evaluations for design changes
Patch/Vulnerability evaluation records and compensating measure plans
Incident response playbooks and exercise reports
Vendor remote access and portable media program documentation
Procurement specifications with cybersecurity requirements and acceptance criteria

Minimum Qualifications
Bachelor's degree in Cybersecurity, Computer Science, Electrical/Computer Engineering, or related field; or equivalent relevant experience.
5+ years of experience in OT/ICS cybersecurity, network engineering, or related roles within critical infrastructure (power, oil/gas, manufacturing, or similar). Nuclear experience preferred but not required.
Strong understanding of OT/ICS environments and constraints (DCS, PLCs, safety systems, HMIs, historians), and common industrial protocols (e.g., Modbus, DNP3, OPC).
Proven experience with network security architecture and controls: segmentation/zoning, firewalls/ACLs, VPN, IDS/IPS, jump servers, and unidirectional gateways/data diodes.
Familiarity with cybersecurity frameworks and guidance relevant to OT, such as NIST SP 800-82 and ISA/IEC 62443, and the nuclear regulatory context (10 CFR 73.54, NRC RG 5.71, site CSP).
Demonstrated excellence in technical writing and documentation: procedures, configuration baselines, risk assessments, test plans, and audit evidence under formal document control.
Experience supporting audits/inspections and managing corrective actions through a CAP.
Understanding of change/configuration management within a quality assurance program (10 CFR 50 Appendix B or similar).
Strong communication and stakeholder management skills; ability to influence without authority in a highly regulated environment.
Ability to obtain and maintain unescorted access authorization (UAA) and meet fitness-for-duty requirements. On-call and off-hours support as needed.

Preferred Qualifications
Direct experience in a nuclear facility or other highly regulated environment with safety-related systems.
Hands-on familiarity with major firewall platforms (e.g., Palo Alto, Fortinet, Cisco), industrial cybersecurity monitoring tools (e.g., Claroty, Dragos, Nozomi), and SIEM platforms (e.g., Splunk, QRadar).
Knowledge of Windows Server/Active Directory in segmented OT networks; allowlisting/application control; backup/restore practices for OT.
Experience writing cybersecurity requirements into design change packages and procurement specs, and validating contractor/vendor compliance.
Familiarity with Work Management, pre-job briefs, human performance tools, and plant procedure use/compliance expectations.
Certifications: GICSP, CISSP, ISA/IEC 62443 (any), GRID, CCNP/CCNA, PCNSE or equivalent. (Certifications are valued but not required.)