OT Cyber Security Engineer

Aurora Dairy Corp.•Boulder, CO

15h•$124,000 - $158,000•Onsite

About The Position

The OT Cybersecurity Engineer is accountable for securing Aurora Organic Dairy’s Operational Technology (OT) environments, including industrial control systems (ICS), SCADA networks, PLCs, HMIs, manufacturing automation, and plant-floor network infrastructure. This role focuses on implementing OT-specific security controls, monitoring for anomalies, managing OT threats, ensuring system integrity, and maintaining alignment with operational reliability and safety. The position also works closely with the Cybersecurity Analyst on audits, DR/BC documentation, compliance evidence, and security governance and with the IT Cybersecurity Engineer role for issues communicated to the OT Cybersecurity Engineer related to OT systems.

Requirements

Bachelor’s degree in Cybersecurity, Engineering, Information Systems, or a related field—or equivalent experience.
3–5 years working with industrial control systems (PLC, SCADA, HMI, DCS) in manufacturing or industrial operations.
Experience designing and implementing OT network segmentation, industrial DMZs, and secure remote access solutions.
Strong understanding of OT protocols including Modbus, Ethernet/IP, Profinet, OPC UA, and BACnet.
Familiarity with ICS cybersecurity frameworks such as ISA/IEC 62443 and NIST SP 800-82.
Experience with OT-specific asset discovery, anomaly detection, or industrial security platforms.
Knowledge of patching limitations, lifecycle constraints, safety considerations, and uptime requirements for OT.
Demonstrated experience collaborating with IT, Controls Engineers, and plant operations teams.
Bachelor's degree in Computer Information Systems or related work experience.
Experience with CISCO and Fortinet (firewalls, routers, switches).
Experience with ITIL.
Experience working with Microsoft Windows Server 2012 R2 and above.
3-5 years of network, server and systems administration experience in a multi-site enterprise environment.
3-5 years of experience in working with wide and local area networks.
Experience with installing, administering and troubleshooting using network security solutions.
Experience advising as to security best practices and participating in executing key security initiatives.
Experience remediating network vulnerabilities based on security assessments and penetration tests.
Experience with tools that actively defend against threats, such as anti-virus, MDR, EDR.
Experience with information security technologies such as event log management, IDS/IDP, SIEM and SOAR, and vulnerability assessments.
Proficient in LAN/WAN/WLAN infrastructures including switches, NICs, fiber, and various network devices and appliances.
Proficient in administering an enterprise class WiFi network.
Experience in troubleshooting routing protocols (BGP, EIGRP, OSPF, Layer 3 switching).
Must possess a valid driver’s license, reliable mode of transportation and proof of automobile insurance with required levels of coverage.

Nice To Haves

Preferred certifications include GICSP, ISA/IEC 62443 Cybersecurity Certificate, Security+, or CySA+.
Fortinet, Cisco and Microsoft Server certifications preferred.
ITIL Foundations Certification preferred.
Experience with Meraki and Ubiquiti preferred.

Responsibilities

Engineers, implements, and maintains OT cybersecurity protections including firewalls, segmented zones, secure remote access, and industrial security controls.
Monitors OT networks and industrial systems for malicious activity, unauthorized changes, or operational anomalies using OT-specific monitoring tools.
Leads OT incident response across production environments, ensuring safe and minimal-disruption containment, eradication, and recovery.
Maintains OT network segmentation, including zoning, conduits, firewall policies, and IT/OT isolation boundaries.
Works closely with engineering, plant operations, and controls technicians to secure PLCs, HMIs, historians, VFDs, and automation systems.
Manages OT patching, vulnerability remediation, and secure configuration baselines aligned with production safety constraints.
Maintains up-to-date OT network diagrams, architecture documentation, asset inventories, and system mapping.
Provides OT cybersecurity guidance to plant engineering and operations groups.
Supports secure commissioning, upgrades, and lifecycle projects for plant automation equipment.
Collaborate with IT, Engineering, and Operations on cross-domain cybersecurity reviews.
Assist with OT-focused security awareness initiatives.
Participate in after-hours maintenance windows and emergency response activities.
Lead annual Disaster Recovery / Business Continuity preparation, table-top exercises, strategy and improvements across Aurora Organic Dairy.
Manages tasks in a fast-paced environment, driving all issues to resolution with a strong focus on customer satisfaction and efficient task execution.
Provides Tier 2 and 3 support for complex issues that cannot be resolved by Service Desk support team.
Coordinates problem resolution with vendors and maintains communications with internal / external stakeholders during the problem resolution process.
Works with network engineering to recommend and implement improvements to overall performance and reliability, including installing, upgrading/patching, monitoring, problem resolution, automation, and configuration management.
Provides cybersecurity guidance related to IT/OT boundary controls and OT network connectivity; IT enterprise network ownership remains with IT Operations and IT Cybersecurity Engineer.
Regularly attends cybersecurity training courses, webinars, and programs to maintain understanding of the ever-evolving threat landscape, industry standards, best practices, and security technologies.
Responsible for remediating gaps identified through vulnerabilities scans and monitoring software.
Supports, communicates, and monitors compliance to information security policies.
Implements and maintains information security awareness and training initiatives for all employees.
Works with IT Operations team to maintain AOD network documentation and assets.