Cyber SDC -Solution Architect - OT Monitoring & Security Tooling

EY•Hartford, DC

5d•$104,800 - $218,500•Hybrid

About The Position

Operational technology environments require sustained visibility, monitoring, security tooling, and operational integration to support stable, secure, and compliant operations. The Solution Architect – OT Monitoring & Security Tooling role provides technical leadership for the strategy, architecture, integration, and continuous improvement of monitoring, asset visibility, detection, and security enablement platforms used in industrial and operational technology environments. This role works across operations, cybersecurity, platform engineering, asset management, network/security operations, SOC teams, vendors, and site stakeholders to improve monitoring coverage, platform health, event visibility, alert quality, and supportability across OT environments. We are seeking a senior Solution Architect – OT Monitoring & Security Tooling to provide solution architecture leadership for OT monitoring, visibility, detection, and security tooling capabilities supporting industrial and operational technology environments. The role is responsible for defining monitoring and tooling strategies, validating platform capabilities, identifying visibility gaps, guiding tool integrations, supporting incident and alert workflows, and aligning OT security tooling with operational support needs. The architect helps ensure monitoring platforms, asset visibility tools, security telemetry, alerting workflows, and operational integrations remain effective as the OT environment scales and matures. This is a senior operations-oriented architecture role focused on platform strategy, monitoring maturity, integration alignment, technical advisory support, and continuous improvement. The role provides technical direction and solution guidance while partnering with operations teams responsible for day-to-day service execution.

Requirements

Bachelor's degree in Information Technology, Cybersecurity, Engineering, Computer Science, or equivalent experience preferred.
8+ years of experience in cybersecurity, infrastructure, monitoring, security operations, operational technology, platform architecture, or solution architecture roles.
Experience supporting monitoring, visibility, security tooling, SOC integration, asset management, or operational support platforms.
Strong understanding of operational technology environments, industrial networks, asset discovery, security monitoring, and managed operations.
Ability to translate operational monitoring and tooling needs into practical architecture, integration, and improvement plans.
Experience collaborating across operations, SOC, cybersecurity, engineering, platform, vendor, and site teams.
Strong analytical, communication, documentation, and technical leadership skills.

Nice To Haves

Experience with OT monitoring or visibility tools such as Nozomi Networks, Claroty, Dragos, runZero, or comparable platforms.
Experience with ServiceNow CMDB, Service Graph, OT asset inventory, vulnerability response, or operational workflow integrations.
Familiarity with SIEM/SOC operations, detection engineering, alert tuning, incident response, and escalation workflows.
Knowledge of network traffic analysis, industrial protocols, Purdue Model concepts, and OT security monitoring approaches.
Experience with vulnerability management, endpoint security, remote access, Zero Trust, firewall, or network security tooling in operational environments.
Relevant certifications such as CISSP, GICSP, GIAC certifications, Security+, Network+, CCSP, ITIL, or comparable security/operations certifications.

Responsibilities

Define and maintain OT monitoring, visibility, and security tooling strategies aligned to operational support needs.
Establish monitoring coverage expectations for OT environments, including asset visibility, network traffic monitoring, platform health, and event visibility.
Identify gaps in monitoring coverage, telemetry quality, alert fidelity, and visibility across site environments.
Develop recommendations to improve monitoring effectiveness, operational supportability, and security outcomes.
Partner with operations and cybersecurity teams to maintain a practical roadmap for monitoring and tooling maturity.
Provide solution architecture leadership for OT monitoring, asset visibility, vulnerability, endpoint, remote access, and security enablement platforms.
Evaluate how OT monitoring platforms integrate with enterprise security services, SOC workflows, CMDB/asset platforms, and operational support tools.
Support architecture decisions for tooling integrations, data flows, alert routing, platform onboarding, and support model alignment.
Coordinate with platform owners and operational teams to improve platform health, coverage, usability, and lifecycle management.
Support standardization of monitoring and security tooling patterns across OT environments.
Define monitoring and alerting requirements for OT security and operational support use cases.
Support development, tuning, and improvement of OT detection logic, alert workflows, escalation paths, and event triage processes.
Partner with SOC, incident response, and operations teams to improve the usability and actionability of OT alerts.
Review alert volumes, false-positive trends, visibility gaps, and escalation performance to drive continuous improvement.
Support integration of OT monitoring outputs with enterprise detection and response processes.
Support solution architecture for OT asset discovery, asset inventory enrichment, and visibility integration with operational systems of record.
Guide integration patterns between OT monitoring platforms, asset discovery tools, CMDB, service management platforms, vulnerability workflows, and reporting capabilities.
Identify opportunities to improve asset context, communication baselines, vulnerability visibility, and operational data quality.
Support definition of minimum required OT asset attributes and data quality expectations for operational support.
Partner with asset management and operations teams to improve asset visibility maturity over time.
Monitor and evaluate health, coverage, reliability, and lifecycle status of OT monitoring and security tooling platforms.
Support planning for platform upgrades, patching, configuration validation, sensor/collector health, data ingestion, and tool lifecycle activities.
Identify operational risks related to platform degradation, incomplete coverage, unsupported integrations, or tooling drift.
Provide architecture guidance for remediation of recurring tooling or monitoring issues.
Support continuous improvement of platform reliability, supportability, and operational maturity.
Serve as a senior technical advisor for complex OT monitoring, tooling, telemetry, visibility, and security platform questions.
Support escalations involving monitoring gaps, alerting issues, integration defects, platform health problems, or operational visibility challenges.
Coordinate with engineering, cybersecurity, SOC, network/security operations, site teams, and vendors to resolve complex tooling concerns.
Translate operational pain points into architecture, integration, or process improvement recommendations.
Provide guidance to operations teams while preserving clear day-to-day operational ownership.
Develop and maintain practical monitoring and tooling guidance for OT operations teams.
Define repeatable patterns for monitoring coverage, alert routing, platform onboarding, asset visibility, and operational integration.
Support lessons learned reviews and identify systemic improvements to tooling, processes, or support models.
Produce architecture guidance, operational playbooks, platform integration notes, and decision records as needed.
Drive continuous improvement of OT monitoring and security tooling capabilities as the operational footprint grows.