OT Cybersecurity Architect

Salary Range

$ - $

Plexus offers a comprehensive benefits package designed to support team members' wellbeing, including medical, dental, and vision insurance, paid time off, retirement savings, and opportunities for professional development. We also prioritize work‑life balance and offer a variety of perks to enhance the team member experience.

The OT Cybersecurity Architect is a strategic role responsible for bridging the gap between our corporate IT security standards and our physical Operational Technology (OT) environments. In this role, you will be the primary authority responsible for defining the security architecture, engineering standards, and risk management frameworks across our manufacturing environment and industrial control systems (ICS). You will ensure that our deterministic, safety‑first production environments are resilient against modern cyber threats without compromising operational uptime or human safety.

• Define OT Security Architecture:
  Design, maintain, and govern a secure, standardized global OT cybersecurity architecture utilizing the Purdue Model and ISA/IEC 62443 frameworks.
• Network Segmentation:
  Design robust Industrial Demilitarized Zones (iDMZs), firewalls, and micro‑segmentation strategies to securely separate IT enterprise networks from the OT environment.
• Technology
  
  Roadmap:
  
  Evaluate, select, and architect OT‑specific security tools (e.g., asset discovery, passive network monitoring, endpoint protection for legacy systems, and industrial SIEM/SOC integration).
• Governance & Standards:
  Establish and maintain enterprise‑wide OT security governance and standards for PLCs, SCADA systems, DCS, HMIs, and other operational technologies relevant to manufacturing.
• Bridge the IT/OT Divide:
  Act as the trusted liaison between Corporate IT/Security teams and Plant Engineering/Operations teams. Translate complex cyber risks into operational impacts for leadership.
• Architecture Review Board (ARB):
  Lead architectural cyber‑strategy and review for all projects affecting OT assets, guarding against unmitigated threats to manufacturing uptime or changes that violate defined cybersecurity policies and safety protocols.
• Vendor Management:
  Partner with major automation vendors to ensure third‑party systems and remote access connections comply with corporate security architecture.
• Risk Assessments:
  Lead threat modeling and vulnerability assessments across disparate manufacturing sites, prioritizing remediation based on operational risk and safety impacts.
• Incident Response Integration:
  Partner with the Enterprise Security Operations Center to architect OT‑specific logging, monitoring, and incident response playbooks that respect the realities of a live production environment.

• Experience:
  
  Minimum of 8–10 years of experience in cybersecurity, with at least 4+ years dedicated explicitly to OT/ICS cybersecurity architecture or engineering.
• Education:
  
  Bachelor’s degree in Electrical Engineering, Computer Engineering, Computer Science, or a related technical field (or equivalent practical experience).
• Industry Background:
  Proven experience working within large‑scale, heavy industrial environments (e.g., manufacturing, pharmaceuticals, utilities, chemicals, or oil & gas).
• Industrial Protocols:
  Deep understanding of proprietary and open industrial protocols (Modbus, Profinet, Ether Net/IP, DNP3, OPC UA).
• Framework Mastery:
  Expert‑level knowledge of ISA/IEC 62443, ISO 27001, NIST SP 800-82, and the Purdue Model.
• Legacy Systems:
  Proven ability to architect defense‑in‑depth approaches around legacy, unpatchable operating systems and embedded firmware without disrupting deterministic operations.
• Secure Remote Access:
  Experience designing zero‑trust or secure multi‑factor remote access solutions for internal engineers and third‑party OEMs.

• SANS GIAC: GICSP, GRID, or GCIP.
• ISA/IEC 62443 Cybersecurity Design/Expert.
• CISSP with a strong portfolio of physical site experience.
• Demonstrated proficiency in cloud‑native architectures utilizing MQTT and other Pub/Sub methodologies.

Hybrid

Up to 25-30% travel to manufacturing/operational sites.

We are an Equal Opportunity Employer (EOE) and do not discriminate based on race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Some offers of employment are contingent upon successfully passing a drug screen and/or background check.