OT Cyber Analyst

OT Cyber Analyst

HF Sinclair is seeking for a OT Cyber Analyst in the following locations Dallas, TX, Arestia, NM, El Dorado, KS, Tulsa, OK, Casper, WY, Sinclair, WY, Salt Lake City, UT, Woods Cross, or Anacortes, WA. The OT Cybersecurity Analyst serves as a fleet-wide Operational Technology (OT) cybersecurity specialist responsible for strengthening the security, visibility, and resilience of Industrial Automation and Control Systems (IACS) across HF Sinclair sites.

The OT Cybersecurity Analyst applies specialized depth and breadth of OT cybersecurity expertise to independently interpret security telemetry, threat and vulnerability information, control gaps, and operational risk; recommend and drive improvements to monitoring, incident response, vulnerability management, asset visibility, secure access, and ISA/IEC 62443-aligned practices; and provide expert guidance to site and enterprise stakeholders.

The role leads complex cross-functional cybersecurity work streams and projects of moderate risk, resource requirements, and complexity, exercises independent judgment within established governance, and drives measurable fleet-wide risk reduction and continuous improvement in coordination with the OT Infrastructure & Cybersecurity Lead, OT System & Infrastructure Specialist, regional support teams, site OT teams, IT, vendors, and business stakeholders.

Job Duties:

• Own and oversee OT cybersecurity monitoring and telemetry health across fleet environments, including SIEM, Syslog, endpoint protection, security dashboards, and approved monitoring platforms.
• Serve as the primary liaison with the 24/7 SOC team to review, investigate, correlate, and escalate OT cybersecurity alerts, suspicious activity, authentication anomalies, remote access events, and policy violations.
• Lead and support OT cybersecurity incident response activities, including investigations, root cause analysis, risk assessments, containment planning, recovery efforts, and corrective actions.
• Develop, maintain, and enhance OT security monitoring use cases, alerting, dashboards, reporting, detection logic, and escalation procedures.
• Identify and resolve gaps in OT asset visibility, monitoring coverage, vulnerability management, and asset inventory systems to improve fleet-wide security posture.
• Lead vulnerability management efforts by reviewing findings, assessing operational risk, prioritizing remediation activities, tracking corrective actions, and reporting results.
• Analyze threat intelligence, security advisories, patches, and vendor notifications to assess operational impact and recommend appropriate mitigation strategies.
• Develop and report cybersecurity metrics related to monitoring coverage, endpoint protection, vulnerability management, asset inventory, and overall fleet visibility.
• Support cybersecurity audits, compliance initiatives, risk assessments, and regulatory readiness activities by validating controls, reviewing evidence, and driving corrective actions.
• Serve as a subject matter expert on OT cybersecurity best practices, including asset visibility, security monitoring, incident response, vulnerability management, and risk management.
• Evaluate vendor risk, third-party connectivity, and secure remote access practices, recommending risk-based controls and improvements.
• Maintain governance of OT asset inventories, network documentation, system records, and cybersecurity documentation to ensure accuracy and enterprise visibility.
• Partner with OT, operations, maintenance, IT, cybersecurity, and vendor stakeholders to improve cybersecurity controls, monitoring effectiveness, and asset visibility across fleet locations.
• Lead cybersecurity projects and work streams, coordinating stakeholders, managing risks, and delivering operational and cybersecurity objectives.
• Provide technical guidance, mentoring, and cybersecurity expertise to site and enterprise teams while translating emerging threats and vulnerabilities into actionable improvements.

Experience:

• At least 5 years of progressively responsible experience in cybersecurity, OT security, IT security operations, systems or network administration, industrial control systems, or equivalent technical disciplines, with demonstrated ownership of complex security activities or programs.
• Demonstrated specialized knowledge of Operational Technology, Industrial Automation and Control Systems (IACS), distributed control systems, PLC/SCADA environments, industrial networks, and refinery/process control environments, with the ability to assess cybersecurity risk in the context of safety, reliability, and operations.
• Advanced hands-on experience with security telemetry and operational security tools such as Syslog collection, SIEM, endpoint protection, vulnerability management, asset visibility, dashboards, ticketing, and reporting, including the ability to improve tool coverage, data quality, detections, and operational use.
• Experience owning or materially improving enterprise or fleet-wide asset inventories, endpoint…