About the Opportunity
Engaged Headhunters has been retained by a Confidential Energy & Critical Infrastructure Operator to recruit a Principal OT / ICS Cybersecurity Architect (anchored in Houston, Texas with hybrid or remote flexibility across the continental United States).
Unlike corporate IT security roles focused on enterprise endpoints, this mandate sits inside operational technology engineering. You will partner directly with substation protection engineers, plant DCS/PLC engineers, and regulatory compliance leadership to harden Purdue Model Levels 0 through 3.5 without introducing latency or tripping live production assets.
Compensation & Package Structure
- Base Compensation: $175,000 to $225,000 annualized base salary depending on ICS/SCADA architecture tenure and active certifications (GICSP, GRID, CISSP, or PE)
- Performance Bonus: 20% annual target bonus tied to NERC CIP audit readiness and capital project security milestones, plus $15,000 sign-on bonus
- Work Arrangement: Hybrid in Houston, TX or Remote (US) with planned quarterly travel for plant walkdowns, substation cutovers, and factory acceptance testing (FAT)
- Benefits: Comprehensive medical, dental, vision, 401(k) with 6% match, 4+ weeks PTO, and paid SANS ICS training / certification renewal stipend
Core Technical Responsibilities
- Purdue Model & IEC 62443 Architecture: Design and enforce zone-and-conduit network segmentation, DMZ architectures, unidirectional security gateways (data diodes), and secure remote access across generation, transmission, and midstream ICS environments.
- Passive OT Threat Detection & Telemetry: Lead architectural deployment and tuning of passive industrial network monitoring platforms (Dragos, Claroty, or Nozomi Networks) integrated with enterprise SIEM/SOAR workflows.
- NERC CIP & TSA Pipeline Compliance: Direct technical controls for NERC CIP-002 through CIP-014 (Electronic Security Perimeters, BES Cyber System categorization, patch management, and configuration change monitoring) and TSA Security Directives.
- Secure Engineering & FAT/SAT Governance: Review vendor PLC, RTU, protective relay, and DCS (Emerson DeltaV, Honeywell Experion, Rockwell, Siemens, SEL) packages during Factory and Site Acceptance Testing prior to energization.
Required Qualifications
- Experience: 6+ years of hands-on cybersecurity engineering or control systems engineering experience, with at least 4+ years dedicated specifically to live Operational Technology (OT), Industrial Control Systems (ICS), SCADA, DCS, or substation environments.
- Standards & Protocols: Deep working fluency with IEC 62443, NIST SP 800-82, NERC CIP, and industrial protocols (Modbus TCP, DNP3, IEC 61850, EtherNet/IP, OPC UA).
- Certifications: Active GICSP, GIAC GRID, CISSP, ISA/IEC 62443 Cybersecurity Expert, or equivalent industrial security credentials strongly preferred.
Confidential Inquiries
All inquiries are handled confidentially by Engaged Headhunters. Our client's identity is never disclosed publicly and your current employer is never contacted without your explicit permission.