Security Compliance Analyst III

Job Title: Security Compliance Analyst III
Location: (Remote)
Duration: 12 Months

Who Actually Succeeds Here

• ICS/OT security analysts and engineers from utilities, power generation, oil and gas, water, manufacturing, or pharma.
• Building automation and Client/BAS security specialists. Data center mechanical and electrical controls people who moved toward security.
• Critical infrastructure vulnerability analysts who work CVE/CVSS triage against embedded and OT devices.
• Network security engineers with OT exposure. Especially anyone who has owned firewall rule review at an IT/OT boundary.
• OT vendor and integrator field engineers from Schneider Electric, Siemens, Johnson Controls, Honeywell, Rockwell, ABB, Eaton, Vertiv, who moved into security roles.
• OT security product company staff from Nozomi, Claroty, Dragos, Tenable OT, Armis, Forescout. Strong protocol fluency.

The LINCS IDC Security & Compliance team is seeking a Contingent Worker (CW) with Industrial Control Systems (ICS) and Operational Technology (OT) expertise to support the Facilities Ecosystem program within the Infrastructure Data Center (IDC) Organization. This CW will work with the Facilities Subject Matter Expert (SME) to serve as the first line of review and triage for Facilities security operational workstreams including network integrity, security and compliance, conducting firmware and vulnerability reviews, reviewing firewall exception requests and security intake processing.

This is a high-volume operational role requiring an individual who can rapidly assess technical security requests, apply structured decision frameworks, maintain accurate documentation, and manage multiple workstreams. The role is structured in two phases: initial operational execution with process documentation, followed by automation development and capacity building.

• Review incoming security intake requests, conduct initial triaging, and route to appropriate SMEs based on defined decision criteria
• Assess existing security processes and controls across the ICS/OT environment
• Escalate complex or out-of-scope items to designated ICS/OT SMEs with complete context and preliminary assessment
• Serve as first-line reviewer for security and compliance program escalations related to ICS/OT products, systems, and components deployed in data center facilities
• Participate in biweekly calls with the NiSC team to address escalations and process improvements
• Process and track firewall exception requests for OT/ICS network segments, validating justification against established security policies
• Manage exception handling workflows including documentation, approval tracking, and periodic revalidation of standing exceptions
• Conduct firmware reviews for ICS/OT devices deployed in Facilities and Robotics environments, assessing known vulnerabilities and patch status
• Perform vulnerability assessments using CVE/CVSS frameworks against OT assets, documenting findings and remediation recommendations
• Identify and implement process improvements to reduce manual effort and improve consistency
• Produce regular status reports on queue volumes, SLA adherence, and backlog trends

Required Qualifications

• Bachelor's degree in Computer Science, Network Engineering, Cybersecurity, or a related field
• 5 years of hands-on security experience
• ICS/OT Security: Understanding of OT security principles, network segmentation, and defense-in-depth strategies for industrial environments, including working knowledge of industrial communication protocols including Modbus (RS485 and TCP/IP), BACnet, Profibus, and associated gateway architectures.
• Ability to assess protocol-level security risks and identify misconfigurations
• Network & Logical Security Fundamentals: Foundational knowledge of firewall rule management, network segmentation principles, and access control models as applied to OT/IT convergence environments
• Knowledge of basic vulnerability assessment frameworks (CVE/CVSS scoring, NVD), firmware analysis and patch management
• Documentation and Process Discipline: Ability to create clear, structured documentation including decision trees, runbooks, and standard operating procedures
• Communication and Escalation Judgment: Clear written communication for security assessments and recommendations. Strong ability to distinguish between items that can be resolved independently vs. those requiring SME escalation

Preferred Qualifications (Trainable)

The following skills are beneficial but not required. The ICS/OT Security SME will provide training and context for organization-specific implementations:

• Master's degree in Computer Science, Network Engineering, Cybersecurity, or a related field
• ICS/OT Security: Experience with industrial control systems in critical infrastructure environments (data centers, power generation, manufacturing, or facilities management)
• Familiarity with Supervisory Control and Data Acquisition or building automation systems used in power distribution, cooling, and environmental monitoring
• Experience working on or managing projects that have enterprise-wide impact and/or multi-organization cross functional stakeholders
• Basic scripting ability (Python, PowerShell, or Bash) or familiarity with AI-agents for developing workflow and process automation