OT and ICS Cybersecurity: 2026 Market Report
Regulators, insurers and boards expect operational technology to be secured with the same rigor as IT, but people who understand both a PLC and a packet capture are rare. Utilities, pipelines and manufacturers are recruiting from the same short list.
NERC CIP-015 is coming
FERC approved CIP-015-1, which requires internal network security monitoring inside electronic security perimeters, in June 2025, with compliance phasing in from 2028. Utilities need engineers who can design and run passive monitoring, not just buy it.
Mandatory and voluntary frameworks overlap
NERC CIP is mandatory for the bulk electric system, and TSA security directives apply to designated critical pipelines. ISA/IEC 62443 is a voluntary standard that customers and insurers increasingly expect in manufacturing.
OT experience cannot be crash-trained
Strong OT security engineers usually started as controls or substation engineers. That path takes years, and IT security hires without plant floor experience often struggle in the role.
The broader field is growing fast
BLS projects employment of information security analysts to grow much faster than average over the next decade, and OT specialists are a small slice of that field.
Methodology. Drivers summarize the published sources below. Pay figures on the pay index are cited individually. Nothing here is a survey by Engaged Headhunters.
Sources
- Covington Inside Privacy, FERC finalizes INSM requirements (CIP-015-1)
- NERC, CIP-005-7 Cyber Security: Electronic Security Perimeter(s)
- TSA, Security Directive Pipeline-2021-02 series
- ISA, ISA/IEC 62443 Cybersecurity Certificate Program
- BLS Occupational Outlook Handbook, Information Security Analysts
- NERC, GridEx