Domain Architect - IT security

Job Summary

OT Architect

The OT Security Architect is responsible for defining, governing and assuring secure, resilient and scalable cybersecurity architectures for industrial and Operational Technology environments. The role translates business, engineering, safety, operational and regulatory requirements into practical target architectures, security patterns, technology roadmaps and implementation guardrails.

This senior role provides technical leadership across brownfield and greenfield environments, balancing cyber risk reduction with production availability, safety, reliability and maintainability. The architect works across engineering, plant operations, enterprise IT, security operations, vendors and programme teams to establish consistent architecture decisions and enable secure transformation.

Key Responsibilities

A. OT Security Architecture and Strategy

• Define and maintain OT cybersecurity reference architectures, principles, patterns, standards and technology roadmaps.
• Assess current-state architectures and develop pragmatic transition states and target-state designs for industrial environments.
• Translate business, operational, safety and security requirements into architecture decisions, control requirements and design specifications.
• Lead architecture reviews for new plants, production lines, industrial platforms, connected products and major technology changes.
• Ensure architectures support availability, safety, resilience, recovery and maintainability requirements alongside cybersecurity objectives. B. Network Segmentation and Secure Connectivity
• Design and govern OT/IT segmentation using zones and conduits, industrial DMZs, security zones, trust boundaries and controlled data flows.
• Define secure connectivity patterns for plant networks, remote sites, cloud or edge services, vendor access and inter-site communications.
• Provide architecture requirements for firewalls, routing, switching, network access control, intrusion detection or prevention, secure gateways and monitoring controls.
• Review firewall and communication matrices to verify business justification, least privilege, traceability and alignment with approved architecture.
• Design secure remote access patterns for employees, vendors and third parties using identity-aware, monitored and time-bound access controls. C. OT Remote Access Architecture and Security
• Define and govern the enterprise OT remote access architecture for employees, engineering teams, OEMs, vendors and third-party support personnel.
• Architect Zero Trust remote access using identity-aware, least-privilege, time-bound and approval-based controls, with session monitoring, recording and auditability where required.
• Define secure deployment patterns for OT remote access platforms such as Cyolo, Secomea and BeyondTrust, and for secure-access capabilities associated with OT security platforms such as Claroty, according to organizational standards and approved use cases.
• Lead architecture and design decisions for Cyolo Secure Remote Access, including resilient platform placement, identity-provider integration, MFA, privileged access, session policies, access workflows, logging and integration with monitoring or incident-response processes.
• Establish access patterns that minimize direct network exposure, restrict lateral movement and protect critical OT assets without disrupting production availability or vendor-support requirements.
• Define onboarding, access approval, periodic recertification, emergency access, session review and offboarding requirements for remote users and third parties.
• Evaluate legacy VPN and jump-server arrangements and define risk-based transition roadmaps toward controlled, identity-centric OT remote access.
• Provide architecture assurance for remote access deployments, upgrades and integrations, including availability, capacity, recovery, logging and operational handover requirements. D. Identity, Access and Platform Security
• Define identity and access architecture for OT users, administrators, service accounts, vendors and non-human identities.
• Establish requirements for privileged access, multi-factor authentication, role-based access, session oversight and credential protection.
• Define security architecture requirements for SCADA, DCS, PLC, HMI, historian, engineering workstation, industrial server, edge and IIoT environments.
• Guide secure integration with enterprise services such as identity providers, PKI, DNS, time services, logging, monitoring and security operations platforms.

Skill Requirements

E. Risk, Compliance and Security Assurance

• Lead OT architecture risk assessments, threat modelling, design reviews and control-gap analyses, and recommend risk-prioritized treatments.
• Embed IEC 62443 concepts, NIST Cybersecurity Framework practices and applicable organizational or regulatory requirements into architecture deliverables.
• Identify compensating controls for legacy, unsupported or operationally constrained assets where standard security controls are not feasible.
• Define security acceptance criteria and provide architecture assurance through design, build, testing, transition and operational handover.
• Support audit, compliance and customer assurance activities with traceable architecture decisions, control mappings and technical evidence. F. Resilience, Monitoring and Incident Readiness
• Define architecture requirements for asset visibility, security monitoring, logging, anomaly detection and integration with SOC or incident response processes.
• Ensure architectures address backup, recovery, redundancy, disaster recovery, configuration integrity and operational resilience.
• Provide senior technical guidance during significant OT security incidents, architecture exceptions and complex risk decisions.
• Use lessons learned from incidents, vulnerabilities and operational events to improve architecture standards and control patterns. G. Stakeholder, Vendor and Delivery Leadership
• Act as the senior architecture interface across plant engineering, operations, IT, cybersecurity, safety, risk, compliance and programme leadership.
• Chair or contribute to architecture governance forums, design authorities, technical workshops and risk-acceptance discussions.
• Evaluate vendor and product architectures, challenge design assumptions and ensure solutions meet approved security and operational requirements.
• Guide engineering and delivery teams without losing accountability for design intent, architecture traceability and technical quality.
• Mentor OT security engineers and architects, promote reusable patterns and strengthen architecture capability across the organization. Technical and Domain Requirements OT/ICS Environments
• Deep understanding of industrial environments and the operational characteristics of SCADA, DCS, PLC, HMI, historian, engineering workstation and industrial server platforms.
• Ability to work within production, safety, lifecycle, availability and change constraints that differ from traditional enterprise IT. Industrial Architecture and Networking
• Strong knowledge of Purdue-aligned architectures, zones and conduits, industrial DMZs, segmentation, network security architecture and controlled OT/IT data exchange.
• Knowledge of industrial and supporting protocols such as Modbus TCP, OPC UA, EtherNet/IP, PROFINET, DNP3, IEC 60870-5-104, MQTT and vendor-specific protocols. Security Technologies
• Architecture-level knowledge of industrial firewalls, IDS/IPS, NAC, OT secure remote access, PAM, IAM, MFA, PKI, endpoint controls, asset visibility, vulnerability management, SIEM and security monitoring.
• Hands-on architecture or design experience with Cyolo Secure Remote Access is strongly preferred; exposure to comparable OT remote access solutions such as Secomea, BeyondTrust and Claroty secure-access capabilities is advantageous.
• Experience integrating security controls with legacy industrial systems, enterprise services, edge platforms and approved cloud services. Architecture Methods and Governance
• Proven ability to produce architecture principles, patterns, standards, roadmaps, design decisions, threat models and risk-based recommendations.
• Experience governing designs through architecture review boards, technical assurance gates, exceptions and implementation oversight. Standards and Risk
• Strong working knowledge of IEC 62443 and NIST guidance for industrial control systems; familiarity with ISO 27001 and sector-specific requirements is advantageous

Other Requirements

• Ability to interpret control objectives and apply them proportionately to industrial risks, operational constraints and business priorities.

• Experience and Qualification Profile

• Minimum 14 years of overall experience in cybersecurity, industrial automation, network security or infrastructure, including substantial experience in OT/ICS environments.
• Demonstrated experience leading OT security architecture for complex, multi-site, brownfield or greenfield industrial programmes.
• Proven experience developing security architectures, segmentation models, risk assessments, standards, roadmaps and design-assurance outputs.
• Experience engaging plant operations, engineering, enterprise IT, security, risk, vendors and senior stakeholders across the solution lifecycle.
• Bachelor’s degree in engineering, Computer Science, Cybersecurity, Information Technology or a related discipline; a relevant master’s degree is advantageous.
• Preferred certifications include IEC 62443 Cybersecurity Expert or equivalent, GICSP, CISSP, CISM, SABSA, TOGAF or other relevant architecture and industrial cybersecurity credentials.
• Experience designing and governing remote access for industrial environments, including Cyolo Secure Remote Access and integration with identity, MFA, privileged-access, monitoring and governance processes.