Senior Cybersecurity Engineer - OT/SCADA

5–8 years in technical cybersecurity or control systems engineering, most of it in OT/ICS environments.

Proven experience securing SCADA and ICS in energy, utility, or heavy industrial settings with regards to live plants, not just labs. This role is centralized, but you need that field background for your requirements to survive contact with a real site.

A track record of getting security implemented through other teams, on technical credibility rather than direct control of the equipment.

Working knowledge of IEC 62443, the Purdue Model, and NIST SP 800-82r3, and the judgment to say what a control will cost in operational risk and propose the alternative.

Industrial networking: you can read a plant network drawing, reason about segmentation, and trace a dropped packet between an HMI and a PLC from a capture.

Centralized identity and directory services (Entra ID, AD/LDAPS, SSO), with the judgment to apply them in OT without creating an availability dependency on the corporate network.

Practical Linux and Windows administration, plus enough scripting to manage the security stack at fleet scale rather than site by site.

OT security platforms: Hands-on with a passive monitoring and asset discovery platform (Nozomi, Claroty, Dragos, Tenable OT, Forescout, Cisco Cyber Vision) or open-source equivalents (Zeek, Suricata, Wireshark, Wazuh), plus SIEM/log aggregation, PKI/CA tooling, and a remote access or PAM platform.

Control systems: Working understanding of at least one SCADA/HMI platform — Ignition, AVEVA, Siemens WinCC, Rockwell FactoryTalk — including its user model, historian, and remote client architecture, enough to write requirements and read its logs; familiarity with PLCs and RTUs (Siemens, Rockwell, Schneider, Beckhoff, SEL) and with PCS, BMS, meters, and protection relays.

Protocols & networking: Modbus TCP/RTU, IEC 61850, OPC UA, with awareness of IEEE 2030.5 and SunSpec for DER; managed industrial switches and firewalls (Cisco, Fortinet, Palo Alto, Moxa, Tofino), VPN architectures, and data-diode gateways.

Also useful: identity provider and single sign-on (SSO) platform, such as Authentik, Zabbix or equivalent for OT infrastructure health, and a preference for tailoring open-source tooling over "black box" commercial platforms.

Preferred Experience

Battery energy storage, solar, wind, or DER. Especially site controller, EMS, and PCS/BMS integration.

NERC CIP program experience, or preparing OT evidence for utility and regulatory audits.

MITRE ATT&CK for ICS, and familiarity with known ICS threat activity (Industroyer, TRITON, PIPEDREAM, FrostyGoop).

Writing cybersecurity requirements into EPC, OEM, or integrator contracts and auditing delivery against them.

Certifications: GICSP, GRID, GCIP, ISA/IEC 62443 Cybersecurity Fundamentals Specialist or higher, SANS ICS410/ICS515, CISSP.

#LI-AD1

For US-based roles - What you’ll get:

Competitive salary + annual performance-based bonus eligibility

Medical, dental, and vision insurance

401(k) with company match

Paid time off and company holidays

For Mexico-based roles - What you’ll get:

Competitive salary + annual performance bonus eligibility

Christmas Bonus (Aguinaldo): 30 days

Major medical expenses and life insurance

Paid time off and holidays (per local policy)

For all roles:

Professional development and growth opportunities

Opportunity to grow with a mission-driven team shaping the future of clean energy

Equal Opportunity: ON.energy is committed to equal employment opportunity and to maintaining a work environment free of harassment, discrimination, or retaliation.

Accommodations: If you need an accommodation during the application process, email recruitment@onenergystorage.com

Benefits vary by role and location and are subject to change.

Agency Notice: ON.energy does not accept unsolicited resumes from staffing agencies, search firms, or third-party recruiters. Resumes submitted without a fully executed Master Services Agreement (MSA) and a written request from an authorized member of our Talent Acquisition team will be considered the property of ON.energy. No placement fees or compensation will be paid for unsolicited candidate submissions.