Business Analyst - Operational Technology

Job Title: OT (Operational Technology) Business Analyst

Role Summary:

The OT Business Analyst will bridge the gap between industrial operations and enterprise IT/security teams by gathering, analyzing, and translating requirements across OT environments (ICS/SCADA). This role supports initiatives such as OT visibility, cybersecurity, asset management, and integration with enterprise platforms while ensuring safety, availability, and regulatory compliance.

Key Responsibilities:

OT Domain & System Understanding:

- Document and analyze OT architecture aligned to the Purdue model (Levels 0-5).

- Work with core OT components:

1. Field devices: Sensors, actuators.

2. Control systems: PLCs, RTUs, DCS.

3. Supervisory systems: SCADA, HMI.

4. Operations layer: Historians, engineering workstations.

5. Integration layer: DMZ, gateways, jump servers.

- Capture dependencies across network protocols (Modbus, OPC-UA, PROFINET).

Requirements Gathering & Analysis:

- Elicit and document business, functional, and technical requirements for OT initiatives.

- Translate OT engineer inputs into business-readable deliverables (BRDs, user stories).

- Conduct workshops with plant operations, engineering, and cybersecurity teams.

- Create process flows, use cases, and current/future state architectures.

OT Cybersecurity & Risk Support:

- Support initiatives aligned to NIST CSF, IEC 62443, NERC CIP.

- Capture requirements for:

1. OT asset discovery (e.g., Tenable OT, Claroty, Nozomi).

2. Network segmentation and IDMZ design.

3. Vulnerability management in OT environments.

- Assist in risk assessments, control mapping, and audit readiness documentation.

Asset Visibility & Data Management:

- Define and validate OT asset inventory requirements (non-CMDB environments).

- Ensure data consistency across tools (Tanium, Tenable, ServiceNow CMDB).

- Support reporting and dashboards for OT risk posture.

Integration & Digital Transformation:

- Gather requirements for integrating OT with enterprise platforms:

1. SIEM (Splunk), data lakes (Snowflake, Databricks).

2. ITSM tools (ServiceNow).

- Support API, gateway, and secure IT/OT integration patterns (Level 3.5 DMZ).

Stakeholder & Governance Management:

- Act as liaison between OT engineers, IT teams, vendors, and leadership.

- Manage conflicting priorities (e.g., uptime vs patching).

- Support governance frameworks, change management, and operational workflows.

Incident, Risk & Compliance Support:

- Document incident response workflows for OT environments.

- Assist in business continuity and disaster recovery planning.

- Translate technical risks into executive-level summaries and dashboards.

Required Skills & Experience:

OT / ICS Knowledge (Core):

Strong understanding of:

1. ICS/SCADA environments.

2. PLCs, RTUs, DCS, HMI systems.

3. Industrial networks and protocols.

- Familiarity with Purdue Model & OT segmentation concepts.

- Knowledge of OT constraints (availability, safety-first design).

Business Analysis Skills:

Expertise in:

1. Requirements gathering (Agile/Waterfall).

2. Documentation: BRD, FRD, user stories, acceptance criteria.

3. Process mapping (Visio, Lucidchart).

4. Stakeholder engagement and workshop facilitation.

- Experience with Jira, Confluence, ServiceNow.

Security & Compliance:

Exposure to OT cybersecurity tools and frameworks.

Understanding of:

1. Vulnerability management in OT.

2. Risk prioritization vs production impact.

- Experience supporting audits and compliance initiatives.

Data & Reporting:

Ability to define KPIs and metrics for:

1. OT risk posture.

2. Asset coverage and visibility.

- Experience with Power BI / dashboards preferred.

Preferred Qualifications:

- Experience in industries like energy, utilities, manufacturing, oil & gas.

- Certifications (nice to have):

1. CBAP / CCBA.

2. GICSP / CISSP / ISA/IEC 62443.

- Exposure to Tenable OT, Nozomi, Claroty, Tanium.

Key Competencies:

- Strong communication translating technical OT business insights.

- Ability to operate in high-risk, regulated environments.

- Balancing security, safety, and uptime constraints.

- Structured, analytical, and solution-oriented thinking.