Operational Technology (OT) Cybersecurity and Network Specialist

CDM Smith is hiring an Operational Technology (OT) Cybersecurity and Network Specialist to design OT network and infrastructure security solutions while supporting IT/OT convergence.

Responsibilities

• Independently develop OT networks with senior level oversight and guidance
• Create basic to moderately complex control system architectures, including network segmentation diagrams, detail drawings, and specifications
• Design OT infrastructure components such as SCADA servers, historians, virtualization hosts, domain services, patching architectures, secure remote access platforms, endpoint protection, data backup solutions, and industrial intrusion detection systems
• Develop IT/OT convergence solutions including Microsoft Active Directory, virtualization server clusters, NextGen firewalls, multifactor authentication, and Demilitarized Zones (DMZ)
• Implement OT cybersecurity requirements using NIST CSF, NIST 800-82, and ISA 62443
• Apply risk-based engineering judgment to balance cybersecurity, operability, maintainability, and lifecycle cost for OT system designs
• Use best practices for managing and securing Windows-based environments
• Evaluate legacy OT systems and recommend improvements, migrations, or replacements based on criticality and risk
• Prepare design reports under limited supervision
• Review basic to moderately complex shop drawings, including cybersecurity project plans, network segmentation plans, firewall policies, control system components, and server or network rack layout diagrams
• Prepare OT Cybersecurity and Automation project budgets and construction cost estimates
• Contribute proposal sections and client presentations under general supervision
• Travel nationally or internationally as required for project sites, client meetings, factory tests, and system start-up
• Perform other duties as required

Requirements

• U.S. Citizenship required due to federal contract requirements and/or eligibility for a U.S. government security clearance
• Intermediate knowledge of network technologies, including VLANs, routing, and Next-Generation Firewalls (NGFW)
• Intermediate knowledge of Windows systems in OT environments, including domain membership strategies, patching constraints, antivirus/EDR considerations, and change control
• Intermediate knowledge of virtualization environments (e.g., VMware, Hyper-V)
• Intermediate knowledge of cybersecurity principles relevant to OT industrial settings
• Fundamental understanding of SCADA (Supervisory Control and Data Acquisition) and DCS (Distributed Control Systems) configuration and implementation
• Familiarity with industrial network protocols and design considerations, including Modbus, DNP3, EtherNet/IP, OPC, availability, determinism, multicast traffic (e.g., IGMP), and maintenance constraints
• Familiarity with NIST CSF, NIST 800-82, and ISA 62443 frameworks to ensure adherence
• Understanding of cloud-based or edge computing solutions as they relate to OT systems
• Awareness of disaster recovery, business continuity, and resilience planning in OT settings
• Strong verbal and written communication skills for geographically diverse teams and clients with varying knowledgebases
• Strong time management and ability to multi-task and prioritize to meet schedules and budgets
• Client-facing experience, comfortable presenting and leading discussions with multidisciplinary teams
• Ability to mentor junior staff and adapt to different learning styles
• Bachelor’s degree in engineering, information systems, computer science, or related field
• 5 years of related experience

Preferred Qualifications

• Experience implementing or supporting cybersecurity and network OT solutions
• CompTIA Security+, GIAC GICSP, ISC2 CISSP, ISA/IEC 62443 certification, or ability to obtain within 6 months
• Sector experience in water/wastewater, facilities, or transportation (plus)
• Familiarity with SCADA/ICS cybersecurity assessments and mitigation strategies

Technology Areas

• VLANs, routing, Next-Generation Firewalls (NGFW)
• Windows, antivirus, EDR, domain membership strategies
• Virtualization environments (e.g., VMware, Hyper-V), virtualization server clusters
• SCADA, DCS, SCADA servers, historians
• Patching architectures, secure remote access platforms, endpoint protection, data backup solutions
• Industrial intrusion detection systems, DMZ
• Microsoft Active Directory, multifactor authentication, NextGen firewalls
• Modbus, DNP3, EtherNet/IP, OPC, IGMP
• NIST CSF, NIST 800-82, ISA 62443, ISA/IEC 62443
• DMZ

Compensation and Work Details

• Location: Denver, CO (hybrid)
• Salary range: USD 95,846 - 167,731 per year
• Additional compensation: bonuses are discretionary and may or may not apply
• Travel required: 20% - 40%
• Driving: valid driver’s license required
• Visa sponsorship: No (no H-1B or TN sponsorship for this position in the United States)

Background Checks and Drug Testing

• CDM Smith may require background checks (criminal, employment, education, licensure, and others as applicable), and may include credit and motor vehicle checks for certain positions
• CDM Smith may conduct drug testing for designated positions
• Background checks are conducted after an offer of employment in the United States
• Outside the United States, background checks vary by country law but will not precede an interview
• Interviews occur before requesting a criminal background check for qualified individuals
• Criminal history will not automatically disqualify a candidate
• During employment, additional background checks (including motor vehicle record) and drug testing may be required

Note: Salary range and pay details listed above correspond to the provided minimum and maximum.