OT Cybersecurity Lead
CREGG · Galway, County Galway, Ireland
Tailor my CV for this job — freeOT Cybersecurity Lead
The role covers how we buy, build and operate machines, from supplier requirements through to patching, legacy management and incident response.Key ResponsibilitiesMaintain an accurate OT asset inventory and use it to identify OS and firmware gaps, unsupported systems and remediation priorities.Decide, for each vulnerability or patch, whether to patch, delay or compensate, and document the rationale and residual risk.Own the OT patching and firmware strategy, including assessment, testing, deployment, exception management and monitoring.Define cybersecurity requirements for components, machine builds and supplier-built equipment before purchase, including support duration, end of support, patching, remote access and logging.Review machine builder, OEM, and system integrator designs and components for cybersecurity and obsolescence.Define compensating controls for legacy and unpatchable systems, including segmentation, access restriction, allowlisting, monitoring and backup.Track EU regulation, including the Cyber Resilience Act, NIS2 and the AI Act, identify where it affects our purchasing and equipment, and work with Legal, Regulatory and Quality on the response.Provide technical direction to engineering, automation, manufacturing, and enterprise cybersecurity teams, and set the standards they follow.Experience and SkillsAt least four years of hands-on OT cybersecurity work, including asset inventory, vulnerability assessment, and remediation. Enterprise security or policy work alone does not meet this requirement.Has built or run OS and firmware patching for production equipment, and can explain how this differs from enterprise IT patching.Can build and maintain an OT inventory and identify gaps against vendor support status for OS, firmware and software.Understands how PLC-based and PC-based machine control systems are designed, updated and validated, sufficient to assess their cybersecurity risk and speak credibly to automation engineers. Programming expertise on specific platforms is not required.Understands how cybersecurity requirements are written into component and machine purchasing, and how supplier lifecycle commitments affect long-term risk.Can explain the practical impact of the Cyber Resilience Act, NIS2 and the AI Act on equipment procurement and operation in plain terms.A Valid EU/Irish work permit QualificationsBachelor’s degree in Automation Engineering, Control Engineering, Electrical or Electronic Engineering, Computer Engineering, Computer Science, Cybersecurity or a related technical discipline, or equivalent substantial industry experience.DesirableIEC 62443 training or certification.GICSP or equivalent industrial cybersecurity certification.Experience in medical device, pharmaceutical or other regulated manufacturing, including working with validation and change control.Experience working with machine builders and OEMs on cybersecurity requirements for new equipment.Experience of multi-site OT programmes and standardising controls across different equipment estates.Working knowledge of industrial networking, segmentation and secure remote access.Experience with OT asset discovery and monitoring tools.Candidate ProfileA practical senior specialist who has worked close to production equipment and can make risk decisions that engineers and manufacturing leaders will act on. They are direct, take ownership of outcomes, and can challenge poor supplier designs or unrealistic timelines constructively