Operational Technology Control Assessor

Key Responsibilities

• Perform assessments of security and risk controls across OT systems, industrial control systems, supervisory control and data acquisition environments, distributed control systems, building automation systems, and related support infrastructure.
• Evaluate control implementation, design effectiveness, and operating effectiveness using approved assessment methodologies and procedures.
• Execute control testing through interviews, documentation reviews, configuration or architecture reviews, evidence analysis, and validation of operational procedures.
• Collect, review, and validate assessment evidence while minimizing disruption to production, safety, mission, or facility operations.
• Review OT architecture, network segmentation, data flows, asset inventories, trust boundaries, remote access paths, vendor access, logging coverage, and interfaces between enterprise IT and OT environments.
• Assess operational practices related to change control, patching, vulnerability management, backup and recovery, incident response, account management, physical access, and configuration management in OT environments.
• Identify control gaps, compensating controls, operational constraints, and risk tradeoffs that affect OT security, resilience, and mission continuity.
• Assess OT controls against applicable frameworks, standards, and organizational baselines such as NIST, NIST SP 800-82, IEC 62443, NERC CIP, CIS Controls, ISO 27001/27002, and program-specific requirements.
• Map OT control implementation and supporting evidence to applicable assessment objectives, regulatory requirements, contractual requirements, and risk management expectations.
• Document assessment activities, evidence reviewed, testing approach, assumptions, limitations, and results clearly and accurately.
• Develop or contribute to OT-focused findings, risk statements, evidence summaries, and remediation recommendations.
• Support corrective action planning by recommending practical, risk-informed improvements that account for operational feasibility and system lifecycle constraints.
• Maintain assessment workpapers and artifacts in accordance with program quality, audit-readiness, and evidence-handling expectations.
• Work with OT engineers, control system operators, system owners, cybersecurity teams, facility personnel, vendors, and business stakeholders to understand control implementation and operational context.
• Clarify assessment requirements, evidence needs, site coordination requirements, and testing expectations with technical and operational personnel.
• Support presentations, status updates, and briefings of OT assessment results as requested by assessment leads or program leadership.
• Apply approved methodologies consistently to ensure assessment results are accurate, repeatable, defensible, and sensitive to safety and operational priorities.
• Escalate significant control gaps, evidence limitations, safety concerns, availability impacts, or cyber-physical risk issues to assessment leadership.
• Support audit readiness, compliance reporting, risk register updates, remediation tracking, and follow-up assessment activities for OT environments.
• Aid in improving OT assessment methodologies, checklists, templates, tools, evidence requests, and reporting processes.
• Participate in lessons-learned activities, reassessments, and process improvement initiatives.
• Stay current with evolving OT cybersecurity threats, control frameworks, regulatory requirements, assessment practices, and industry best practices.

Required Skills

• U.S. Citizenship with ability to obtain and maintain a DOE “L” clearance after start.
• 3-5 years of experience in cybersecurity, risk management, compliance, audit, control assessment, OT security, industrial control systems, or related technical roles.
• Experience supporting or executing formal control assessments, audits, compliance reviews, cybersecurity evaluations, or OT security assessments.
• Working knowledge of security control frameworks and OT-relevant guidance such as NIST, NIST SP 800-82, IEC 62443, CIS Controls, NERC CIP, ISO, or organizational control baselines.
• Ability to analyze OT architecture diagrams, network diagrams, system security documentation, policies, procedures, configurations, and operational evidence.
• Understanding of OT risk considerations, including safety, availability, reliability, segmentation, remote access, vendor access, patching constraints, and lifecycle limitations.
• Strong written documentation skills, including the ability to develop clear findings, evidence summaries, and risk statements.
• Ability to communicate effectively with technical, operational, and non-technical stakeholders.

Desired Skills

• Experience in regulated, critical infrastructure, industrial, manufacturing, energy, utilities, transportation, healthcare, government, or defense environments.
• Familiarity with OT or ICS technologies such as SCADA, PLCs, DCS, HMIs, historians, engineering workstations, serial-to-IP gateways, industrial protocols, and OT monitoring tools.
• Experience assessing technical, administrative, physical, and operational controls across OT, enterprise IT, and hybrid IT/OT environments.
• Familiarity with system security artifacts such as SSPs, policies, procedures, POA&Ms, risk registers, architecture diagrams, asset inventories, network diagrams, and audit evidence repositories.
• Certifications such as Security+, GICSP, GRID, GCIP, CISA, CRISC, CISSP, CAP, CGRC, ISA/IEC 62443, or equivalent experience.