Operational Technology Security

OT Engineer / Contractor Support

Location: Monaca, PA

Joining: Immediate

Work Authorization: Visa independent candidates

Duration: 6-12 months, Contract-to-Hire (CTH)

Our client is seeking an experienced Operational Technology (OT) Security contractor to keep site OT assets running safely, reliably, and securely. This is a hands-on run-and-maintain role.

Role Overview

· Scope: site OT assets in network Levels 1 to 3.5, including DCS, SIS, PLCs, HMIs, network infrastructure, backup and supporting systems.

· Focus: execute and document preventive and corrective maintenance across control, safety, server, endpoint, and network systems.

· Reports to: the assigned OT Engineer and asset custodians.

· Works with: Operations, PACO / Control Systems, OT Security, IT, maintenance teams, and system vendors.

· Standards: site risk-based OT Security Maintenance Policy, asset-specific plans, vendor requirements, permits, and Management of Change (MOC).

· Note: the contractor executes work but does not approve risk, changes, or vendor updates.

What You'll Do

1. Maintenance Planning & Records

· Plan and execute assigned OT maintenance based on asset criticality, the maintenance schedule, the OT Asset Register, the Backup Plan, vendor guidance, and operating windows.

· Log all preventive, corrective, and cybersecurity work in the OT Security SharePoint Maintenance Tracking Tool (asset ID and class, dates, task details, findings, and personnel).

· Report incomplete or abnormal work and escalate overdue tasks to the Asset Custodian and the OT Security Site Process Focal Point (SPF).

· When operating constraints block the work, help defer it to the next outage, document the reason, and apply temporary mitigations (enhanced monitoring, limiting changes or remote access, checking backup and failover readiness).

· Obtain work permits, including Permit Vision questionnaires, and follow approved site access procedures.

2. Backups, Antivirus & Patching

· Verify system and configuration backups per the OT Backup Plan, report failures, and support recovery checks.

· Keep antivirus definitions current on Windows OT assets. Escalate when they are more than a week out of date and validate the alerting mechanism quarterly if no alerts occur.

· Patching schedule:

o Systems not affected by automatic restarts: quarterly

o Systems with operational impact (after vendor approval): every 6 months for high and medium risk, annually for low risk

· Before patching, confirm asset classification, vendor approval, operational impact, maintenance window, and MOC / permit. Never force restarts on process-control, safety, or continuous-production systems.

3. Firmware & Network Maintenance

· Review switch and firewall firmware at least every 2 years, or sooner if a critical vulnerability is reported.

· Check control-system and PLC firmware with vendors at least annually. Apply only vendor-approved changes (for Emerson systems, only Emerson-recommended updates and procedures).

· When online updates are not feasible, defer to the next planned outage with documented risk acceptance and interim controls.

· Review firewall rules to confirm they are documented, justified, and least-privilege, and remove obsolete rules through change management.

4. Physical Inspections

· Inspect cabinets, panels, and racks for integrity, locking, water ingress, heat, and dust. Record issues and follow up.

· Inspection schedule:

o Quarterly: CCB server-room cabinets, GTG control-system cabinets (PEEEC building), SKF magnetic-bearing PLCs, Bently Nevada BN3500 racks

o Every 6 months: DeltaV field cabinets, STG control-system cabinets (PEEEC building), Woodward PLC cabinets, PSA cabinets (FAR #3), Prognost racks

o Annually: Rockwell PLC cabinets, Additives control cabinets

5. Access, Cyber Defense & Spares

· Review user, service, and privileged accounts quarterly and flag inactive, default, shared, or expired vendor accounts for removal.

· Review OT cyber-defense reports monthly and route relevant events to the OT Security team.

· Maintain the critical OT spares record (non-SAP) and review it annually for condition, readiness, and firmware compatibility.

· Track spare usage and coordinate early with vendors on long-lead items.

6. Change Control & Troubleshooting

· Troubleshoot OT hardware, software, network, backup, and endpoint issues, and tell operational faults apart from security events.

· Make changes only under approved MOC, with testing, rollback, and documentation.

· Coordinate impact assessments and maintenance windows with the Asset Custodian, PACO, Operations, OT Security, IT, and vendors.

· Keep records and handover notes up to date and support outage and turnaround planning.

Requirements

• Relevant experience supporting OT, industrial automation, control systems, or industrial infrastructure in a continuous-process or similarly safety-critical operating environment; typically five or more years in a related role.
• Hands-on experience maintaining and troubleshooting Windows-based OT assets, PLC / DCS systems, industrial networks, and associated servers or applications.
• Working knowledge of risk-based maintenance, cybersecurity fundamentals, patch and firmware lifecycle practices, account access reviews, backups, and change control in OT environments.
• Demonstrated ability to execute permitted work safely, follow detailed procedures and vendor instructions, document work accurately, and escalate issues without disrupting production or safety functions.
• Strong coordination, written communication, troubleshooting, and recordkeeping skills across Operations, engineering, IT, OT security, maintenance, and external vendors.
• Relevant technical degree, associate degree, or equivalent combination of technical training and practical OT experience.
• Must meet applicable site access, work authorization, and contract-firm requirements.

Technology Environment

Relevant experience with comparable systems is valuable; candidates are not expected to know every platform. The site environment includes Emerson DeltaV / DeltaV SIS; Rockwell PLCs; Siemens control systems; GE Mark VIe; Woodward; SKF magnetic-bearing PLCs; Bently Nevada 3500; Prognost; Windows OT servers and endpoints; virtualization; industrial firewalls and switches; OPC and Modbus; PI System; backup / recovery tools; SolarWinds; Nozomi; and endpoint-protection platforms.

Preferred Qualifications

• Experience in petrochemical, chemical manufacturing, refining, LNG, or another continuous-process industry.
• Experience supporting planned maintenance, turnarounds, commissioning, or outage execution in a live operating facility.
• Vendor training or experience with DeltaV, Rockwell, industrial networking / firewalls, OT virtualization, system backups, endpoint protection, or OT asset / threat monitoring.
• Familiarity with IEC 62443 concepts, OT asset inventories, SharePoint-based maintenance records, and permit / MOC workflows.

Contractor Role Boundaries

The contractor executes work assigned by the site OT Engineer / Asset Custodian and follows applicable site policies and vendor procedures. Approval of MOC, risk acceptance, access authorization, maintenance deferrals, and vendor-specific updates remains with the designated site authorities and / or required vendors. The contract firm should identify any proposed schedule, coverage, or mobilization details separately.