OT Cybersecurity Engineer

Cypress Creek Renewables•Durham, NC

6h•Hybrid

About The Position

Cypress Creek Energy is seeking an OT Cybersecurity Engineer to protect the SCADA and operational technology systems that monitor and control its generation sites. The role maintains OT systems by keeping them patched, protected from malware, monitored for intrusions, and resilient, working with the SCADA team, IT, operations, and vendors while avoiding disruption to operations. The engineer manages OT patching and vulnerability remediation; endpoint protection and malware response; network intrusion detection, alert triage, and incident response; active and passive vulnerability assessments; and disaster recovery, backups, resiliency, and restoration testing. The role also maintains security documentation and asset inventories, collects evidence for NERC CIP requirements at CIP low- and medium-impact sites, aligns controls with NIST 800-82 and NIST CSF, and supports security assessments. The preferred location is the Durham, North Carolina office. The team follows a hybrid schedule, with three in-office days per week.

Requirements

At least 4 years of experience in cybersecurity, security operations, or OT/IT systems security.
Hands-on experience with patch management and vulnerability scanning.
Experience administering antivirus or endpoint protection tools and responding to detections.
Working knowledge of network protocols and traffic analysis, including Wireshark and IDS/IPS tools.
Experience with Windows and Linux system administration.
Clear written and verbal communication skills and the ability to work across technical and non-technical teams.

Nice To Haves

Experience in ICS/SCADA or OT environments such as solar, wind, or utilities.
Working knowledge of NERC CIP requirements and compliance evidence.
Familiarity with OT protocols such as DNP3, Modbus, and IEC 61850, and OT monitoring platforms such as Dragos.
Experience with the listed tools or comparable products.
Preferred certifications such as Security+, GICSP, GCIP, CISSP, or CEH.
Scripting or automation experience with Python, PowerShell, or Ansible.

Responsibilities

Track vendor advisories and vulnerabilities affecting OT assets, including SCADA servers, HMIs, historians, RTUs/PLCs, firewalls, switches, routers, and cellular gateways.
Test and schedule patches with vendors and site teams; document approvals, maintenance windows, rollback plans, and exceptions.
Run vulnerability scans, prioritize findings by risk, track remediation to closure, and report patch compliance and open vulnerabilities across sites.
Deploy and manage antivirus and endpoint protection on OT-appropriate Windows and Linux hosts, including scan schedules and operationally safe exclusions.
Review security detections, investigate suspicious activity, remediate infected or at-risk systems, and manage removable media and transient asset controls for vendor and field laptops.
Monitor OT network traffic with intrusion detection and monitoring tools such as Dragos, Zeek, Snort, or similar, and tune rules to reduce false positives.
Triage and investigate SIEM alerts, determine scope and impact, and escalate or contain incidents as needed.
Maintain and test incident response plans, including tabletop exercises with IT, operations, and vendors; review firewall logs, VPN activity, and remote access for anomalies.
Plan and perform active OT vulnerability assessments during approved maintenance windows using validated methods that minimize operational risk.
Conduct passive vulnerability assessments using network monitoring, asset discovery, configuration reviews, and available threat intelligence without disrupting control-system operations.
Analyze and prioritize assessment findings based on exploitability, asset criticality, operational impact, and applicable OT cybersecurity requirements.
Develop mitigation and remediation plans with asset owners, operations, IT/OT, and vendors; validate corrective actions and track findings through closure or documented risk acceptance.
Coordinate third-party external vulnerability assessments, including scope and rules of engagement, access, results review, and follow-up actions.
Develop and maintain site-specific OT disaster recovery procedures, including system dependencies, restoration priorities, recovery time and recovery point objectives, and vendor contacts.
Maintain and monitor secure backups of SCADA servers, HMIs, historians, controller programs, and network device configurations, including offline or immutable copies.
Perform scheduled backup restoration and disaster recovery exercises with operations, IT/OT, and vendors; document results, verify data integrity, and track corrective actions to closure.
Assess OT systems for single points of failure, maintain redundancy and critical spares, and coordinate failover testing within approved maintenance windows.
Coordinate safe restoration of OT services after outages or cyber incidents, validating configurations, communications, and control functionality with operations before returning systems to service.
Collect and maintain evidence for NERC CIP requirements covering patching, malware prevention, configuration baselines, vulnerability assessments, and incident response at CIP low- and medium-impact sites.
Align controls with NIST 800-82 and NIST CSF, and support internal and third-party security assessments.
Maintain asset inventories, network diagrams, and security documentation.
Work with regional teams and third-party vendors on remote access, change control, and security requirements.