OT Cybersecurity Analyst

OT Cybersecurity Analyst

Location: Corpus Christi, Tx

Description:

The OT Cybersecurity Analyst supports the Corpus Christi Automation Department in deploying, integrating, and sustaining OT cybersecurity capabilities across the refinery's control systems. The role leads technical execution of platform deployments, develops monitoring and response workflows, supports incident response, and helps build the procedures and training needed for long-term sustainment. The Analyst works closely with Automation, Operations, IT, and Corporate Cybersecurity and supports the site's role in the company's OT Cybersecurity program.

Key Responsibilities:

• Lead technical deployment, commissioning, and integration of OT cybersecurity platforms, including Nozomi (passive detection, vulnerability identification, threat intelligence), SolarWinds (network management), XONA (secure remote access), Octave/Hexagon Integrity (asset inventory and configuration management), and secure file transfer (Axway).


• Define monitoring strategy, alert tuning, baselines, and escalation paths for OT networks and control system assets.


• Investigate and analyze alerts and anomalies; correlate across platforms to separate genuine threats from false positives and normal process behavior.


• Serve in OT Cyber Support and OT Network Support roles under the OT Cyber Incident Response Plan (OT CIRP), including triage, evidence preservation, containment recommendations, and lessons learned.


• Perform security architecture reviews and risk assessments of DCS, PLC, SIS, historian, and network infrastructure consistent with ISA/IEC 62443 and NIST guidance.


• Support asset inventory, vulnerability, and patch-risk assessment for Honeywell (Experion/TPS), Emerson DeltaV, Rockwell, Triconex, and associated servers and workstations.


• Develop and maintain procedures, standards, runbooks, and documentation; support Management of Change for cybersecurity-related modifications.


• Coordinate with Corporate Cybersecurity on SIEM/log integration, threat intelligence, and enterprise standards.


• Train and mentor Automation staff and the OT Cybersecurity Technician on platform use and procedures.


• Report program status, metrics, and risks to the Automation Manager.

Required Qualifications:

• 5–10 years of experience in industrial control systems, automation, OT networking, or OT cybersecurity, with at least 3 years focused on OT/ICS cybersecurity.


• Direct experience in refining, petrochemical, chemical, power generation, oil & gas, or similar continuous-process industrial operations.


• Working knowledge of DCS, PLC, and SIS architectures and industrial protocols (e.g., Modbus, OPC/OPC UA, EtherNet/IP).


• Hands-on experience deploying or administering at least one OT network monitoring or asset visibility platform (e.g., Nozomi, Claroty, Dragos, Industrial Defender, Tenable OT).


• Understanding of network segmentation, Purdue model, firewalls, DMZs, switches, and Windows server/Active Directory in OT environments.


• Familiarity with ISA/IEC 62443, NIST CSF, and NIST SP 800-82.


• Valid TWIC (Transportation Worker Identification Credential) card at time of start.


• Ability to work safely on-site in an operating refinery and communicate clearly with operators, engineers, and IT.

Preferred Qualifications:

• Bachelor's degree in Engineering, Computer Science, Information Security, or related field (equivalent experience accepted).


• Certifications such as GICSP, GRID, ISA/IEC 62443 Cybersecurity Expert/Specialist, CISSP, or Security+.


• Experience with Honeywell Experion/TPS and/or Emerson DeltaV.


• Experience with Nozomi, SolarWinds, XONA, Axway, or PAS/Hexagon Integrity.


• Experience supporting incident response, tabletop exercises, or regulated security programs (e.g., TSA, USCG MTSA).

Work Environment:

• Work is performed at an operating petroleum refinery. Candidates must follow company safety, PPE, permitting, and Management of Change requirements and be able to work in operating units, control rooms, and equipment rooms.


• This is a 100% on-site position at the Corpus Christi Refinery. Remote or hybrid work is not available.


• Candidates must pass company and contractor-agency background, drug, and safety screening.


• Normal schedule is day shift, Monday–Friday, with occasional after-hours or call-out support during incidents, outages, and turnarounds