Senior Analyst, OT Security

Fervo Energy (NASDAQ: FRVO) is a modern power company developing next-generation geothermal resources to meet the growing demand for affordable, reliable, 24/7 carbon-free energy. Our mission is to transform geothermal into America’s most dependable and affordable source of clean, around-the-clock power. By combining innovations in horizontal drilling, fiber-optic sensing, and advanced reservoir engineering, Fervo has developed a repeatable approach to building utility-scale enhanced geothermal systems.

Our flagship Cape Station development in Utah is planned to deliver 500 MW of firm, carbon-free power, and we are advancing a development pipeline of more than 50 GW. Join us and work alongside world-class engineers, geoscientists, operators, project builders, and business leaders working to make geothermal a cornerstone of a more reliable, affordable, and sustainable energy future.

The Senior OT Security Analyst is a hands‑on cybersecurity professional responsible for strengthening the security and resilience of Fervo’s operational technology environments. The role partners with Operations, OT and controls engineering, project delivery, IT, enterprise cybersecurity, compliance, legal, and third parties to translate OT security program objectives into durable technical controls, operating processes, and defensible evidence.

This analyst evaluates OT architectures and data flows, supports secure commissioning and change management, improves asset and configuration visibility, governs remote and vendor access, develops monitoring and incident‑response capabilities, and maintains risk and remediation records. The role applies NIST SP 800-82 Rev. 3 and IEC 62443 concepts and supports NERC CIP governance where applicable, without independently determining regulatory applicability or certifying compliance.

OT Program Governance and Risk

Translate program objectives into execution. Develop and maintain practical OT security standards, procedures, control requirements, checklists, and review cadences that can be used by site, engineering, project, and vendor teams.

Maintain the OT risk lifecycle. Document risk scenarios, operational consequences, existing safeguards, treatment plans, owners, due dates, exceptions, accepted risks, and closure evidence.

Support governance and assurance. Prepare status metrics, decision records, issue escalations, control evidence, and review materials for OT cybersecurity and compliance forums.

Support NERC CIP readiness where applicable. Partner with Compliance and accountable business owners on asset scoping, control ownership, recurring evidence, exception management, and audit preparation; avoid unsupported compliance conclusions.

Asset, Vulnerability, and Configuration Management

Improve OT asset awareness. Maintain or validate inventories for controllers, RTACs, HMIs, historians, engineering workstations, network devices, security appliances, communications gateways, and supporting services.

Assess vulnerabilities in context. Evaluate exposure, exploitability, operational consequence, compensating controls, vendor guidance, and outage requirements rather than relying on CVSS scores alone.

Strengthen configuration control. Define secure baselines, configuration backup expectations, account and service reviews, network rule reviews, time synchronization, and change records for critical OT components.

Coordinate remediation. Work with asset owners and vendors to plan testing, approvals, maintenance windows, rollback, validation, and closure evidence for patches and other risk treatments.

Monitoring, Incident Response, and Recovery

Develop safe OT monitoring coverage. Identify priority log sources and passive network visibility…