OT Vulnerability & Integration Architect

OT Solution Architect

Requirements :

1. Service Now certifications: CSA (Certified System Administrator;

2. CIS-VR (Vulnerability Response), ), or CIS-Sec Ops

3. OT Discovery and OT VM Certifications

4. OT Visibility (integrating with other solutions supporting plant sites like Maximo-location of the asset in the facility, Qualys- assets , Tenable- VM scanner, Forescout- VM scanner) for the data to support

5. OT Vulnerability Management and populate the CMDB.

Job Description / Responsibilities :

Integration Architecture & Development

• Design and build bi-directional integrations between Service Now and Tanium, Maximo, Forescout, and Qualys using REST/SOAP APIs, MID Servers, Integration Hub spokes, and custom scripted APIs.

• Ensure data integrity and synchronization for asset, configuration, and vulnerability data flowing between Service Now CMDB/CSDM and source systems.

• Build and maintain integration error handling, retry logic, logging, and monitoring/alerting for all connected systems.

• Map and normalize data schemas across platforms (e.g., Qualys QID to Service Now Vulnerable Item, Forescout device classification to CMDB CI, Tanium asset/patch data to CI attributes, Maximo asset/work order data to OT asset records).
Vulnerability Management Process Automation

• Architect and automate the full vulnerability management lifecycle in Service Now: ingestion → asset/CI correlation → risk scoring/prioritization → assignment → remediation workflow → verification → closure.

• Build Service Now Flow Designer/Workflow automations to orchestrate remediation tasks, approvals, exception/risk-acceptance processes, and SLA-based escalations.

• Configure automated ticketing and work order creation in Maximo for OT asset remediation, tied back to Service Now vulnerability records.

• Implement automated network segmentation/containment triggers leveraging Forescout for high-risk or unpatchable OT assets.

• Build logic to reconcile Tanium patch/configuration data with Qualys scan results to reduce false positives and validate remediation.
Documentation & Audit Trail

• Configure Service Now to automatically document all actions taken (system and human) across the vulnerability lifecycle — including timestamps, source system, decision rationale, approvals, and remediation evidence — to support audit, compliance, and regulatory reporting (e.g., IEC 62443, NIST 800-82).

• Build reporting dashboards and performance analytics (MTTR, SLA compliance, risk exposure trends) using Service Now Performance Analytics/Reporting.

• Maintain integration and workflow documentation, runbooks, and data flow diagrams.
OT-Specific Considerations

• Apply OT-appropriate remediation strategies (compensating controls, segmentation, virtual patching) when direct patching is not feasible due to safety, uptime, or vendor constraints.

• Partner with OT engineering and plant/site teams to validate that automated actions do not disrupt production or safety systems.

• Maintain a unified IT/OT asset and vulnerability inventory within the Service Now CMDB/CSDM.
Collaboration & Governance

• Work with Security Operations, IT, OT Engineering, and Compliance teams to define workflow requirements, escalation paths, and risk acceptance criteria.

• Support change management and testing (dev/test/prod) for all integration and workflow changes.

• Provide subject matter expertise on Service Now Vulnerability Response and OT Security module capabilities and roadmap.

Required Qualifications

• 4+ years of experience administering or engineering on the Service Now platform, including:
Vulnerability Response (VR) and/or OT/IoT Security modules;
Flow Designer / Workflow Editor;
Integration Hub, REST/SOAP Message integrations, MID Server configuration; CMDB/CSDM data…