Security Sr. Consultant - Operational Technology

Summary

Why WWT?

World Wide Technology (WWT) strives to make a new world happen. WWT's work benefits clients and partners as much as it does its people and community across the globe.

Founded in 1990, WWT brings together strategy, deep technical expertise and world-class partnerships to help public and private sector organizations design, build and scale intelligent AI, digital, cybersecurity, cloud and infrastructure solutions. Through its Advanced Technology Center (ATC)-a collaborative ecosystem featuring state-of-the-art hardware and software-WWT enables clients and partners to conceptualize, test and validate innovative technology and then deploy solutions at scale using its global integration and distributions capabilities.

With more than 14,000 team members and over 60 locations globally, WWT's culture-grounded in core values and leadership philosophies-has been recognized by Fortune® and Great Place to Work for its commitment to innovation, trust and creating a great place to work for all. WWT provides products and services to large enterprise, global service provider and public sector clients in up to 130 countries across six continents. Softchoice, a World Wide Technology company, supports commercial and SMB markets in the U.S. and Canada.

Want to work with highly motivated individuals on high-performance teams? Join WWT today!

What is the Solutions Consulting & Engineering (SC&E) Team and why join?

Solutions Consulting & Engineering is an organization that is Customer Focused and Solutions Led. We deliver end-to-end and emerging solutions to drive customer satisfaction, increase profitability and growth. Our success is enabled by our world-class management consulting, delivery excellence and engineering brilliance. Our goal is to bring together business acumen with full-stack technical know-how to develop innovative solutions for our clients' most complex challenges.

Position Overview:

World Wide Technology (WWT) is seeking a Security Sr. Consultant to own the technical execution of operational technology and industrial control system security engagements across critical infrastructure and manufacturing clients. This is a consulting role: you lead defined workstreams from discovery through analysis and design, and you author the deliverable content that defines the client's OT security posture and remediation plan. You are the consultant the client's representatives work with day to day, operating under the direction of a Lead Consultant or Principal Consultant who holds overall engagement accountability and final deliverable quality.

OT engagements are governed by constraints that do not apply in enterprise IT: availability and safety outrank confidentiality, change is bound to management-of-change processes and outage windows, and a meaningful share of the installed base runs unsupported operating systems on vendor-warranted equipment that cannot be patched or actively scanned. Engagements follow a consequence-driven, standards-anchored methodology: you baseline the environment through passive discovery and structured site walkdowns, model zones and conduits against the Purdue reference architecture and IEC 62443-3-2, assess controls against ISA/IEC 62443, NIST SP 800-82, and the client's applicable regulatory obligations, and sequence remediation against operational consequence and the constraints of the outage calendar.

Recommendations must be executable by the personnel responsible for operating the facility. This is a full-time position with a defined growth path toward the Lead Consultant level. Previous security consulting experience and a portfolio of client-facing deliverables are strongly preferred, as is direct time spent working in operating industrial environments.

Key Responsibilities

1. Own technical execution of assigned OT security workstreams , driving day-to-day progress, quality, and pace against the agreed schedule and scope, escalating scope and commercial matters to the engagement lead.
2. Plan and conduct OT discovery : asset inventory and network baselining, control system architecture documentation, protocol and traffic analysis, remote access path enumeration, patch and lifecycle posture, backup and recovery review, and third-party and vendor access review.
3. Conduct site walkdowns and structured interviews with controls engineers, plant IT, operations, maintenance, safety, and vendor personnel; document the environment as operated and reconcile it against drawings and asset records, which are frequently outdated.
4. Operate safely on client sites : complete required site safety training and work within client PPE, escort, permit, and lockout/tagout requirements without exception.
5. Model zones and conduits against the Purdue Enterprise Reference Architecture and IEC 62443-3-2, documenting current-state trust boundaries, IDMZ posture, and the cross-level flows that deviate from the model.
6. Assess controls against applicable standards and regulations , including ISA/IEC 62443, NIST SP 800-82r3, NIST CSF 2.0, and the client's obligations under NERC CIP, TSA Security Directives, AWIA, CISA Cross-Sector Cybersecurity Performance Goals, or sector equivalents, documenting the evidence behind every finding.
7. Assess and rationalize OT security technology already deployed , including passive monitoring and asset visibility platforms, secure remote access, firewalls and unidirectional gateways at the IDMZ, endpoint controls where supported, and backup infrastructure; recommend the approach per gap for engagement-lead review, and justify net-new capability rather than assuming it.
8. Account for AI systems in scope by identifying machine learning and analytics components in the OT environment, including ML-based anomaly detection within monitoring platforms, vendor-hosted predictive maintenance and remote diagnostics, and any pathway by which process data leaves the facility or automated action is returned to it; document the resulting conduits and trust boundaries.
9. Account for operational and safety interlocks : understand how safety instrumented systems, management-of-change processes, validated environments, and turnaround windows constrain remediation, and shape recommendations consistent with the facility's actual change calendar.
10. Author deliverable content : clear, well-structured, client-ready documents and presentations covering current-state architecture, gap and risk analysis, zone-and-conduit design, and a phased roadmap, for Lead Consultant or Principal Consultant review.
11. Run pre-readout reviews with client SMEs , including the controls and operations personnel whose endorsement determines whether the plan is implemented; present findings to project sponsors and working-group leadership, and support the engagement lead on the executive readout to client leadership.
12. Support deliverable review cycles , incorporating feedback across review iterations and driving documents toward acceptance, partne...