Security Architecture Engineer II

White Plains, NY, US, NY 10606 White Plains, NY, US, NY 10606 White Plains, NY, US, NY 10606 Austin, TX, US, 78701 Chicago, IL, US, 60654 Austin, TX, US, 78701 Chicago, IL, US, 60654 Chicago, IL, US, 60654 Austin, TX, US, 78701

RWE Americas, LLC
To start as soon as possible, full time, permanent
Functional area: IT / Digital
Remuneration: Exempt

Join RWE Americas' OT Security team and take architectural ownership of the security controls protecting our grid-scale generation fleet. As the Security Architecture Engineer II
, you will design and build the defenses standing between live industrial control systems and the threats targeting them, across 160+ wind, solar, and battery storage sites plus natural gas-powered generation in 27 states.

The Security Architecture Engineer II's core focus will be maturing a defensible, standards-based OT security architecture and the platform stack that enforces it. Acting as the technical design authority for operational technology, you will set the reference architectures and secure baselines that every new project is built to, and own the OT security toolchain end to end.

Role Responsibilities:

• Security Architecture & Platform Ownership:
  • Own the architecture and operation of the OT security toolset — asset visibility and access control, monitoring and SIEM, vulnerability management, endpoint protection, and ICSAware detection. Define how each platform is laid out and behaves across the fleet, including sensor placement, data flows, policy and enforcement structures, and integration into enterprise security systems, then configure, tune, and lifecycle-manage the platforms and set a repeatable deployment standard for new and acquired sites
• Maintain OT security standards, secure configuration baselines, and hardening requirements aligned to ISA/IEC 62443 and CIS Benchmarks, along with version-controlled reference architectures, connectivity maps, and network diagrams reflecting current and planned state
• Onboard OT logs and telemetry into enterprise monitoring platforms with reliable normalization and event forwarding, build and tune OT-specific detection content, and partner with the SOC on use cases, alert routing, and escalation paths
• Risk Assessment & Vulnerability Management:
  • Perform in-depth OT risk assessments using MITRE ATT&CK for ICSAware to map attack paths and control gaps, operate a risk-based vulnerability remediation cadence with plant teams, and validate fixes in staging environments ahead of production rollout
• Incident Resolution:
  • Act as technical escalation point for OT security incidents, leading investigation, threat hunting, and root-cause analysis, and shaping containment plans that respect operational safety and availability constraints
• Access & Third-Party Assurance:
  • Define least-privilege roles, privileged account controls, access reviews, and MFA where feasible; design secure remote access for internal engineers and vendors; and review OEM- and vendor-supplied designs and third-party connectivity into OT environments, recommending mitigations for identified gaps
• Security Requirements in Projects & Procurement:
  • Embed OT security requirements into new-build and repowering projects, acquisitions, and OEM and EPC contracts, and review proposed designs and connectivity before commitments are made
• Cross-Functional Partnership:
  • Serve as the OT security point of contact for OT, plant operations, asset management, project engineering, and the SOC — sequencing security work around maintenance windows and outages, and translating risk into terms each audience can act on
• Team Enablement & Knowledge Transfer:
  • Produce the runbooks and technical guidance the team runs on, provide informal mentorship to junior analysts and engineers, and deliver hands-on…