At SolutionsPT, our OT Cyber Security Consultants sit within the Cyber Services Team, part of the One Technical Team (OTT). The team advises industrial and critical infrastructure clients on how to understand, measure and reduce cyber security risk in their operational technology environments.

This is primarily an advisory and assessment role. Most of the time is spent assessing client environments against recognised standards, writing up what is found, and helping clients decide what to do about it. There is also a hands-on element: supporting the deployment and configuration of OT security products, either on our own engagements or alongside other OTT teams on larger projects. Consultants are advisors first, and the product work supports that rather than replacing it.

The work is a mix of remote and on-site. Site work can mean walking operational areas, interviewing engineering and operations staff, reviewing architecture and systems in place, and collecting evidence. Expect to be at client sites and offices across the UK and Ireland up to 25% of the time.

The role reports to the Cyber Services Team Manager and works alongside colleagues across the OTT, drawing on their systems and infrastructure knowledge and providing cyber security input to their work in return.

Written English matters a great deal in this role. The report is the deliverable. Consultants also need to hold their own in a room with control engineers, IT managers and directors, and adjust how they explain things to suit whoever is in front of them.

Key Responsibilities

Client delivery:

• Understand what a client is trying to achieve and the constraints they are working under, and translate that into a realistic scope, effort estimate and set of deliverables.
• Carry out OT cyber security assessments on site and remotely, against recognised standards such as ISA/IEC 62443, the NCSC Cyber Assessment Framework and NIST SP 800-82. This includes documentation review, structured interviews with engineering and operations staff, walkdowns of operational areas, architecture review and evidence collection.
• Carry out structured risk assessments using a defined methodology such as IEC 62443-3-2, including partitioning into zones and conduits, consequence analysis and setting target security levels.
• Write clear, evidence-based reports with prioritised remediation recommendations a client can act on, and present and defend those findings to audiences ranging from control engineers to executive sponsors.
• Review existing and proposed OT architectures and advise on segmentation, secure remote access, monitoring, backup and hardening, including where compensating controls are the only realistic option for legacy or unsupported systems.
• Advise clients on the regulatory obligations affecting their OT environments, including NIS2, the EU Cyber Resilience Act, the EU Machinery Regulation and the UK Cyber Security and Resilience Bill.
• Design and run client workshops, tabletop exercises and training, and help clients build and exercise their OT incident response arrangements.

Product and project support:

• Support the deployment, configuration and handover of OT security products at client sites, and produce the accompanying design, configuration and acceptance test documentation.
• Provide cyber security input to project work led by other OTT teams.

Team and capability:

• Peer review colleagues' deliverables.
• Contribute to the team's assessment methods, templates, tooling and reference material, and provide guidance and mentoring to more junior members of the team.
• Keep current with OT threat activity, vulnerabilities and advisories relevant to our clients' sectors, and with the standards, regulations and technologies we work with.
• Identify where a client would benefit from further support and refer it to the appropriate team. Advice given to a client must be the right advice for that client, irrespective of what it means commercially.

General:

• Work with minimum supervision, remotely, at SolutionsPT premises and at client sites.
• Follow client site safety requirements without exception, including inductions, permits to work, and any restrictions on connecting equipment or interacting with live systems.
• Maintain and improve quality and client satisfaction, as measured by our clients' Net Promoter Scores.
• Escalate technical or commercial concerns to your line manager.

Authority and Accountability

• Accountable for the technical correctness and suitability of the advice you give, within the scope of your experience, and for escalating or seeking senior review where a question falls outside it.
• Authority to determine the most appropriate advice, assessment approach or methodology to meet a client or colleague's requirement, subject to peer review of deliverables before issue.
• Accountable for on-time and on-budget delivery of the consultancy and project work assigned to you, and for adherence to SolutionsPT processes, procedures and working practices and to client site rules.
• Accountable for keeping your technical knowledge and certifications current, and for stakeholder satisfaction both internally and externally.

In addition to these responsibilities, employees are required to carry out such other duties as may reasonably be required.

Skills, Qualifications and Competence Level

Essential:

• Demonstrable experience working with industrial control systems, in an operational, engineering or security capacity.
• Working knowledge of ISA/IEC 62443 and the NCSC Cyber Assessment Framework, with enough familiarity with at least one of them to assess a client against it.
• A recognised security certification, for example GICSP, ISA/IEC 62443 Cybersecurity Fundamentals Specialist, or equivalent demonstrable experience. Candidates without one will be supported and expected to work towards an appropriate certification.
• A sound grasp of why OT security differs from IT security.
• Enough understanding of Windows Server, Active Directory, virtualisation, IP networking and industrial protocols to review, question and document how a client is using them.
• Strong written English and the ability to structure a technical report, together with presentation skills that can be tailored from Engineer to C-Suite.
• Willingness to travel to client sites across the UK and Ireland, and a full driving licence.
• Being able to align to the company values.

Desirable:

• Experience carrying out formal assessments or audits against standards such as ISA/IEC 62443, the NCSC CAF, NIST CSF
• Hands-on experience deploying or configuring OT security platforms, covering network monitoring and asset discovery, OT vulnerability management, secure remote access or OT endpoint protection.
• Sector experience in one or more of manufacturing, food and beverage, water, energy, oil and gas, pharmaceutical or transport, and exposure to SCADA and HMI platforms, preferably the AVEVA portfolio.
• Awareness of the wider UK and EU regulatory position, including NIS2, the EU Cyber Resilience Act, the EU Machinery Regulation and the Cyber Security and Resilience Bill, and of sector regimes such as NERC CIP.
• Experience facilitating tabletop exercises or OT incident response planning.
• Understanding of safety instrumented systems and the interface between cyber security and functional safety.
• Eligibility for UK security clearance, as some client sites require BPSS or higher.