Senior OT Cybersecurity Engineer

About the Position:

The OT (Operational Technology) Cybersecurity Engineering and Innovation team is responsible for the strategic and technical direction of OT/IACS (Industrial Automated Control System) cybersecurity in Chevron. OT Cybersecurity Engineers support activities such as secure-by-design, standardized solutions and network architectures, and the secure implementation of OT/IACS digital technologies across Chevron. The Senior OT Cyber Engineer is responsible for supporting the strategic direction of OT/ IACS Cybersecurity in multiple domains, architectural design of OT/IACS Cybersecurity safeguards as well as the secure implementation of all OT digital technologies across Chevron. OT Cybersecurity Engineers are cybersecurity influencers functioning at the Chevron Enterprise level, reaching broadly across multiple IT Foundational Platform product lines and select Digital Platforms and Business Units. These engineers have a grasp of business breadth, along with technical depth to help stakeholders make quality cybersecurity investment decisions. This role positively impacts global cybersecurity practices, in various operating assets and environments, delivering on the Chevron cybersecurity integrated risk management strategy

Job Description :

• Contribute to developing strategic OT/IACS Cybersecurity initiatives, technology projects and security programs across the Chevron Enterprise globally

• Contribute to the design and review of secure IACS/OT network architectures and data flows including communication between applications, ports, protocols, and services

• Contribute to the creation of OT/IACS cybersecurity guardrails to ensure all OT architectures, solutions and technologies across the Chevron enterprise are built using a secure-by-design methodology

• Utilize industry standards and frameworks (e.g., NIST-800-53/82, IEC-62443, MITRE ATT&CK / D3FEND), to identify capabilities and technologies to provide enhanced cyber defenses in diverse scenarios

• Support OT cybersecurity initiatives by partnering with Product Owners, delivering cybersecurity engineering solutions, and advancing tools such as Axonius, Tenable.

• Develop OT cybersecurity research project proposals. Research, test, and/or lead proof-of-concepts for new and emerging OT technologies.

• Lead cybersecurity assessments for Chevron’s Business Unit IACS designs/installations and/or emerging technology OT solutions to determine criticality rankings and risk gaps

• Lead OT cybersecurity assessments including detailed design reviews, system and component descriptions, identification and selection of evaluation criteria, network topology reviews, mapping of data flows to ports, protocols, and services tables

• Provide security recommendations for normally unmanned facilities where Industrial Internet of Things (IIoT), optimization, “Big data” analytics, and OT integration with the Cloud are being considered.

• Provide recommendations and plans to mitigate identified issues from OT cybersecurity risk assessments, IACS Vulnerability assessments, and OT Pen tests

Required education

• Bachelor's degree or master's degree in information technology, Computer Science, Engineering, or related STEM field

Preferred qualifications

• Certifications in Industrial Control Systems Cybersecurity or in IT Cybersecurity are highly preferred (e.g., GISCP, GCIP, CISSP, IEC-62443 or other similar certification)

Required work experience

• Minimum 6+ years related work experience in Operational Technology/Industrial Controls Systems Cybersecurity field with increasing levels of responsibility.

• “Hands-On” experience with OT/IACS critical infrastructure in energy or similar industries.

Other preferred skills / competencies

• Experience in utilizing frameworks and standards such as NIST-800-53/82 and IEC-62443 in an IACS environment

• Experience in designing secure-by-design OT/IACS network architectu implementing cybersecurity technologies, and applying Purdue Model-based segmentation.

• Understanding of threats, vulnerabilities, attack paths and exploits in an OT/IACS environment