Senior Analyst, OT Security

Fervo Energy • Houston, TX

1d • Hybrid

About The Position

The Senior OT Security Analyst is a hands-on cybersecurity professional responsible for strengthening the security and resilience of Fervo Energy’s operational technology environments. The analyst partners with Operations, OT and controls engineering, project delivery, IT, enterprise cybersecurity, compliance, legal, and third parties to turn OT security objectives into durable technical controls, operating processes, and defensible evidence.

The role evaluates OT architectures and data flows; supports secure commissioning and change management; improves asset and configuration visibility; governs remote and vendor access; develops monitoring and incident-response capabilities; and maintains risk and remediation records. It applies NIST SP 800-82 Rev. 3 and IEC 62443 concepts and supports NERC CIP governance where applicable, without independently determining regulatory applicability or certifying compliance.

The position may be based at Fervo Energy offices in Houston, Texas; Golden, Colorado; Reno, Nevada; Oakland, California; or Salt Lake City, Utah. It follows a hybrid schedule, with employees expected to work in the office three days per week. Travel to Fervo sites and participation in approved commissioning, maintenance, incident, or recovery windows may be required as business needs require.

Requirements

• Typically 5 or more years in cybersecurity, controls, industrial networking, or related engineering, including at least 3 years focused on OT/ICS security or closely related operational environments.
• Working knowledge of SCADA, PLCs or RTACs, HMIs, historians, engineering workstations, industrial communications gateways, firewalls, managed switches, and remote-site communications.
• Strong understanding of TCP/IP, routing, switching, VLANs, firewalls, VPNs, and common industrial protocols such as DNP3, Modbus TCP, OPC UA, or comparable control-system communications.
• Demonstrated ability to assess architectures, analyze logs and incidents, manage vulnerabilities, document risk, define controls, and coordinate remediation in environments with uptime and safety constraints.
• Practical familiarity with NIST SP 800-82 Rev. 3 and IEC 62443 concepts.
• Working knowledge of NERC CIP governance and evidence expectations is required where assigned responsibilities involve applicable assets or processes.
• Ability to produce clear technical documentation, explain operational consequences to varied audiences, facilitate cross-functional decisions, and escalate material risk constructively.
• Bachelor’s degree in cybersecurity, engineering, computer science, information systems, or a related discipline, or an equivalent combination of education and relevant experience.
• Ability to travel to Fervo sites and participate in approved commissioning, maintenance, incident, or recovery windows as business needs require.

Nice To Haves

• Experience in power generation, geothermal operations, utilities, renewable energy, substations, industrial process control, or other critical infrastructure.
• Hands-on experience with OT network monitoring, SIEM, secure remote access, privileged access, vulnerability-management, firewall-management, or configuration-backup platforms.
• Experience supporting greenfield design, commissioning, site acceptance, management of change, and transition from project delivery to sustained operations.
• Relevant certifications such as GICSP, GRID, CISSP, or equivalent technical and industry credentials.
• Experience coordinating third-party integrators, OEMs, EPCs, operations vendors, or managed service providers in industrial environments.

Responsibilities

• Develop and maintain practical OT security standards, procedures, control requirements, checklists, and review cadences for site, engineering, project, and vendor teams.
• Maintain OT risk records covering scenarios, operational consequences, safeguards, treatment plans, owners, due dates, exceptions, accepted risks, and closure evidence.
• Prepare status metrics, decision records, escalations, control evidence, and review materials for OT cybersecurity and compliance forums.
• Support NERC CIP readiness where applicable by partnering on asset scoping, control ownership, recurring evidence, exception management, and audit preparation.
• Maintain or validate inventories of OT assets and supporting services, including controllers, RTACs, HMIs, historians, engineering workstations, network devices, security appliances, communications gateways, and services.
• Assess vulnerabilities in context, considering exposure, exploitability, operational consequences, compensating controls, vendor guidance, and outage requirements.
• Define secure configuration baselines and expectations for backups, account and service reviews, network-rule reviews, time synchronization, and change records.
• Coordinate remediation with asset owners and vendors, including testing, approvals, maintenance windows, rollback, validation, and closure evidence.
• Identify priority log sources and passive network visibility points, and support secure collection, normalization, alerting, retention, and management of documented blind spots.
• Triage OT security anomalies and alerts, correlate technical evidence with operating conditions, preserve records, coordinate escalation, and distinguish cyber activity from equipment or process faults.
• Maintain OT-specific incident-response playbooks, contacts, decision paths, communications procedures, evidence handling, and interfaces with enterprise response and site emergency processes.
• Support backup and restoration testing, configuration recovery, clean rebuild planning, manual or degraded operating procedures, and lessons-learned tracking.
• Promote secure privileged and remote access practices, including individual identities, MFA, brokered access, least privilege, time-bound approval, controlled file transfer, session logging, emergency access, and prompt revocation.
• Review vendor access and support models, including business need, technical reach, approval authority, support windows, monitoring, account ownership, contractual responsibilities, and offboarding.
• Assess OT dependencies on shared services such as identity, DNS, time, virtualization, cloud, cellular, and IT-managed services, and document resilient or degraded-mode options.
• Partner with engineering and operations teams to explain operational risks and select proportionate, maintainable, and supportable controls.
• Maintain current, reviewable architecture baselines, data-flow records, standards, procedures, exceptions, risk decisions, evidence packages, and remediation status.
• Deliver role-appropriate OT security guidance and exercises for operators, engineers, project teams, service providers, and incident responders.
• Track program effectiveness indicators, including asset coverage, critical logging coverage, remote-access accountability, overdue high-risk actions, backup validation, and exception aging.
• Travel to Fervo sites and participate in approved commissioning, maintenance, incident, or recovery windows as business needs require.

Benefits

• Medical, dental, and vision plan options.
• Employer-paid basic life insurance and short-term and long-term disability coverage.
• A 401(k) plan with up to 6% match.
• Flexible paid time off and paid parental leave.
• Family-building, fertility, hormonal health, pregnancy, postpartum, and parenting support through Carrot.
• A dependent care FSA for eligible child and elder care expenses.
• An annual Lifestyle Spending Account for eligible wellness expenses, including fitness, financial planning, pet insurance, and pet care.
• Employee ownership opportunities through Fervo’s Employee Stock Purchase Program, stock option grants, and bonus opportunities for eligible roles.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior