OT System Architect

About the role

The OT Architect will play a key role in designing and supporting secure OT networks across Chemtrade’s manufacturing facilities. This role focuses on strengthening the reliability of OT network, OT/IT network segmentation, and cybersecurity controls in alignment with industry standards (ISA, NIST, NERC IP etc).

Responsibilities

• Design and deploy security solutions to protect OT systems against cyber threats, including firewalls, intrusion detection/prevention systems, and endpoint security software.
• Implement Chemtrade’s OT Cybersecurity Program, including network design, segmentation, and monitoring across plant environments.
• Design, configure, and maintain Cisco network devices (switches, routers, VLANs, wireless controllers) and Firewalls in OT networks.
• Manage and administer firewalls (WatchGuard, Fortinet, Palo Alto) to protect OT environments, OT DMZs, and remote access connections.
• Design, configure, and implement OT DMZ.
• Implement Purdue Model–aligned network segmentation (ISA-95/ISA 62443, NIST SP 800-82) to separate IT, OT DMZ, and plant levels.
• Collaborate with IT, Corporate Electrical Reliability and Site teams to securely integrate IT, PLC (Programmable Logic Controllers), DCS (Distributed Control Systems), BMS (Burner Management System (BMS), SIS (Safety Instrumented Systems) with OT networks.
• Support and implement secure vendor and remote access solutions (VPN, jump hosts, MFA).
• Support asset inventory, vulnerability management, intrusion detection, and incident response in OT systems (e.g., Claroty, Palo Alto, SIEM).
• Maintain network diagrams, architecture documentation, and configuration standards for all OT environments.
• Contribute to OT risk assessments, audits, and disaster recovery planning.
• Provide technical support for OT networking issues across multiple Chemtrade sites.
• Establish and manage Process Control Network(PCN) network Domains and user access.
• Work with IT infrastructure team to integrate, implement, and maintain security tools in OT environments across the plants.
• Work with third-party vendors and contractors to ensure that their systems and services are secure and compliant with company policies.
• Maintain up-to-date knowledge of industry best practices, new security threats, and emerging technologies to ensure OT security measures are effective and current.
• Collaborate with IT and engineering teams to ensure that OT systems are integrated with the overall IT infrastructure in a secure and compliant manner.
• Analyze, troubleshoot, and investigate security related incidents, events, and alerts using proper tools or even manual techniques.
• Provide support for audit and remediation activities as required.
• Manage the process of gathering, analyzing and assessing the current and future threat landscape, as well as providing a realistic overview of risks and threats in the operational environment.
• Aid in the development of training, procedures, and documentation for internal and external audiences.

Qualifications

• Bachelor’s degree in Electrical/Electronics, Computer Science, Information Technology.
• Relevant certifications such as CCNA/CCNP, GICSP, Fortinet NSE, Palo Alto PCNSE are preferred.
• 7+ years of experience in designing, developing and maintaining industrial OT/ICS network infrastructure.
• Solid understanding of Purdue Model and OT network zoning.
• Understanding of cybersecurity frameworks (NIST SP 800-82, NIST CSF, IEC 62443, CIS Controls).
• Experience in MS operating sytems, MS Server, MS Hypervisor, Knowledge of deploying the networking associated with enterprise Process Historians such as Aveva P or Canary.
• Hands-on experience with Cisco network devices (switches, routers, VLANs, routing protocols), firewalls (WatchGuard, Fortinet, Palo Alto), VPN, DMZ, and secure remote access.
• Knowledge of PLC, DCS, BMS and SIS architecture and their integration with OT networks preferably Rockwell, Emerson, Honeywell, ABB.
• Familiarity with industrial protocols (Modbus, DNP3, Ethernet/IP, OPC UA, PROFINET).
• Familiarity with asset management and monitoring tools (e.g., Claroty, Nozomi).
• [CH1.1] Knowledge of AWS Cloud (including EC2, S3 and VPC) and Hyper-V virtualization.
• Knowledge of Domain Controllers and Active Directory in a Windows environment and integration with network devices.
• Strong communication and interpersonal skills, with the ability to collaborate effectively with cross-functional teams.
• Safety-first mindset when working in chemical plant environments.
• Effective communicator with both technical and non-technical audiences.
• Flexibility to travel (~25%) to Chemtrade plant sites.
• Experience in deployment of security controls in endpoints, industrial networks, including network zoning, segmentation and isolation designs and implementation.
• Understanding of general cybersecurity frameworks (ISO IEC 27001/27002, ISO 15408, NIST Cybersecurity Framework (CSF), NIST SP800-53).
• Hands on implementation experience of current and emerging state-of-the-art OT systems technologies, architectures, and products.
• Knowledge of ISA/IEC 62443 Cybersecurity, Ability to collaborate effectively at all levels and functions.
• Strong organizational skills.
• Self–starter with ability to work as part of a team.
• Excellent time management and analytical skills.
• Ability to learn new processes and technologies quickly.