OT CYBER Security

Role & responsibilities

• Cybersecurity governance: Define enterprise-wide IT/OT security roadmap, policies, risk register, standards, ownership and management dashboards; align practices with ISO 27001, NIST CSF and relevant legal/customer obligations.
• IT security controls: Govern endpoint/XDR, email security, firewalls, secure network architecture, vulnerability management, MFA, privileged access, identity governance, cloud security and third-party access.
• SAP and application security: Partner with SAP/application owners on role-based access, privileged access, interfaces, security assessments, change control, logging and secure application delivery.
• Manufacturing OT security: Establish asset inventory and risk classification for PLCs, SCADA, HMIs, industrial networks, engineering workstations and connected plant assets; implement appropriate segmentation, monitoring and secure vendor connectivity.
• OT operational resilience: Coordinate with plant automation/engineering teams on risk-based patching, backups, restoration testing, configuration baselines and maintenance windows without compromising safety or production availability.
• AI-era threat defence: Address AI-enabled phishing, deepfake impersonation, business email compromise, credential theft and automated attacks; strengthen verification procedures and security awareness.
• Secure enterprise AI adoption: Define guardrails for GenAI tools and internally developed AI applications covering confidential data, access, prompt injection, model/application integrations, logs and vendor risk.
• Detection and response: Oversee SOC/MSSP, SIEM, alerts, incident triage, containment, forensic coordination, root cause analysis, cyber tabletop exercises and IT/OT recovery playbooks.
• Assurance and improvement: Commission VA/PT and OT security assessments; track remediation closure, exceptions, audits, supplier risk and cybersecurity improvement projects to completion.
• Collaboration and leadership: Engage business, plant heads, engineering, HR, legal and vendors; communicate material cyber risks and investment priorities to management in business terms.

3. Qualifications & Experience

• Bachelors degree in Computer Science, IT, Electronics, Electrical Engineering or related discipline; relevant postgraduate education is an advantage.
• 15 years of progressive cybersecurity / information security experience, preferably within manufacturing or process industries.
• Hands-on understanding of enterprise security operations and direct experience with industrial OT/ICS environments and plant-level risk controls.
• Working knowledge of ISO/IEC 27001, NIST CSF, IEC 62443 and industrial security architecture; experience with incident management and audit closure.
• Preferred certifications: CISSP, CISM, GICSP, IEC 62443-related credentials or equivalent relevant credentials.
• Exposure to SAP security, AWS & AZURE cloud security, SOC/SIEM, EDR/XDR and AI security risks will be advantageous.

4. Behavioural Competencies

• Risk-based judgment, ownership, integrity and sound incident decision-making.
• Ability to work hands-on while leading external security partners and cross-functional improvement programmes.
• Strong communication, stakeholder influence and ability to balance plant uptime with cyber risk reduction.

5. Expected Outcomes / Success Measures

• Approved and prioritised IT/OT cybersecurity roadmap with quarterly progress and risk reporting.
• Complete visibility of critical IT and OT assets, assigned owners and documented high-risk exposures.
• Timely closure of critical vulnerabilities and audit findings, with tracked exceptions and agreed risk acceptance.
• Demonstrated readiness through incident response simulations, verified backups and recovery exercises.
• Measurable improvements in email/identity protection, security awareness, vendor access and monitoring coverage.
• Secure governance process for enterprise GenAI and internally developed AI applications.

6. Working Relationships

Internal: Corporate IT, engineering/automation, SAP and application teams and business leadership.

External: SOC/MSSP, cybersecurity consultants, auditors, technology OEMs and industrial system integrators.