Hiring cybersecurity talent for industry and OT
Hiring cybersecurity talent in manufacturing and industry: which profiles secure OT, where to find them, how to assess them and how to win them over.
A manufacturer hiring in cybersecurity is not looking for quite the same people as a bank or a software company. Its production lines run on controllers built to last for decades, availability comes first, and a careless action can affect people's physical safety. This guide helps industrial leadership and CISOs choose the right profiles, find them and assess them without aiming at the wrong target.
Why OT changes the picture
OT (operational technology) covers the systems that run the physical world: programmable logic controllers, SCADA supervision, human-machine interfaces, fieldbus networks, safety instrumented systems. Securing them follows different rules from corporate IT.
- Availability first. Stopping a line to apply a patch can cost a day of production. Maintenance windows are rare and planned far ahead.
- Ageing equipment. Unsupported operating systems are common, and updating them can mean requalifying the whole installation.
- Physical safety. A poorly controlled action on a controller can have physical consequences. An aggressive network scan, routine in corporate IT, can disrupt fragile equipment.
- Many owners. The industrial network often belongs to production or maintenance, not to IT. Integrators and equipment vendors frequently have remote access.
These constraints do not rule out people from IT, but they demand a certain stance: listen to production teams, understand the process before proposing controls, and accept trade-offs.
The framework driving demand
Several texts and standards shape the field and fuel the demand for skills.
- NIS2. Directive (EU) 2022/2555, available on eur-lex.europa.eu, lists energy, water and transport among sectors of high criticality, and several branches of manufacturing among other critical sectors. Many manufacturers fall within scope for the first time. Our article on the profiles to hire for NIS2 sets out the general approach.
- ANSSI guidance. The French national cybersecurity agency publishes on cyber.gouv.fr a classification method and detailed measures for industrial control system security.
- The IEC 62443 series. This international standard organises the security of automation systems into zones and conduits, with security levels and separate requirements for asset owners, integrators and manufacturers.
- The Cyber Resilience Act. For manufacturers that build connected products themselves, it adds product-side obligations. See our article on the profiles to hire for the Cyber Resilience Act.
Check the exact scope that applies to your company with your legal and compliance teams.
The profiles a manufacturer needs
Few manufacturers need every one of these roles. Use the table to spot the gaps.
| Profile | Role in an industrial setting | Common background |
|---|---|---|
| Group CISO or head of cybersecurity | Owns a policy covering both IT and OT, arbitrates with plant managers | IT CISO with production experience, OT engineer turned manager |
| OT security engineer | Asset mapping, segmentation, hardening, integrator remote access | Automation engineer, industrial network engineer, IT security engineer trained in OT |
| Security architect | Designs IT/OT separation, signs off new smart factory projects | Network or security architect, integrator |
| SOC analyst with OT visibility | Works with industrial detection sensors, triages alerts with the plants | SOC analyst trained in industrial protocols |
| GRC analyst | Risk analysis, NIS2 compliance, alignment with IEC 62443 and ANSSI guidance | IT GRC, quality, functional safety |
| Site cybersecurity champion | Local relay, awareness, follow-up of actions on the ground | Volunteer maintenance or automation lead, trained in-house |
Two points. First, the site champion is usually not an external hire: it is someone from the plant who is given time and training. Second, the OT security engineer is the rarest and most contested role. It will get its own guide in the Journal.
For the overall logic (which role to start with, what to outsource), see our article on building a security team.
Where to find candidates
The pool of experienced OT security specialists is small. Waiting for the perfect candidate, expert in both automation and cybersecurity, often drags the search out with no guarantee of success. Three complementary pools deserve your attention.
Automation and process engineers
They know the controllers, the processes and the plant culture, and production teams trust them. What they often lack are the basics of network security, identity management and detection. Those can be learnt, provided you plan for upskilling and a mentor. Our guide to hiring career changers largely applies.
IT security engineers
They bring method, tooling and knowledge of attacks. The risk is overzealousness: applying corporate IT reflexes on the shop floor. Assess their listening skills and curiosity about the process as much as their technical depth.
Integrators and equipment vendors
Integrator engineers have seen many sites and many architectures. They are often tempted to move to an asset owner for more stability and less travel. That is an argument worth putting forward.
Assessing without missing the point
A good OT interview measures three things: understanding of industrial constraints, solid security skills and the ability to work with production. A few useful scenarios:
- The patch you cannot apply. A critical vulnerability affects a supervision system, but the next shutdown window is months away. What do you propose meanwhile? A good answer covers compensating controls (segmentation, filtering, closer monitoring), not just the patch.
- The vendor's remote access. A vendor asks for permanent access for remote maintenance. How do you control it?
- Asset mapping. How do you inventory a site's equipment without disrupting production? Expect a preference for passive listening and coordination with automation engineers.
- Reading a diagram. Show a simplified plant architecture and ask where to draw zone boundaries and control points.
These exercises are best prepared with someone who knows the field. Our article on structuring a technical security interview gives the general method, and our guide to assessing skills beyond the CV explains how to build scenarios that resemble the job.
Winning candidates over to a plant
Security candidates often have several options. Industry has real strengths, as long as you present them honestly.
- Tangible impact. Protecting a production line, a water treatment plant or an energy network carries a meaning many candidates look for.
- Location and travel. Sites are sometimes far from major cities. Say clearly where the role is based, how much travel between sites it involves and what can be done remotely.
- Working hours. Interventions often happen during planned shutdowns, sometimes at weekends. Say so from the first conversation, along with the compensation offered. Our article on remote work and on-call duties helps you prepare those discussions.
- Leadership support. A serious candidate will want to know whether OT security has a budget and a sponsor, or rests on one person facing reluctant plant managers.
Mistakes to avoid
- Hiring a pure IT profile without preparing them. Without time on site and a contact in production, they risk clashing with the teams in the first few weeks.
- Attaching the role to one site only. An OT security engineer isolated in a plant, with no link to the group CISO, struggles to move cross-site topics forward.
- Asking for everything at once. A job ad demanding IEC 62443, five controller brands, detection, pentesting and governance puts off good candidates.
- Forgetting integrators. Part of your security depends on them. Your new hire will need to manage them and enforce access rules.
- Underestimating the timeline. Experienced OT profiles are rare. Plan ahead, and consider upskilling someone close to the profile.
In short
Securing industry takes people who can reconcile cybersecurity, availability and physical safety. Start by identifying the missing functions, widen your sourcing to automation engineers, curious IT engineers and integrators, and assess on scenarios that look like your plants. A well-scoped hire beats a long wait for the ideal candidate.
Looking to strengthen the cybersecurity of your industrial sites? At Cyber Recrut, a recruiter and a security practitioner scope the role with you and run the search together. Our shortlisted candidates prove their skills on hands-on labs tailored to the role. See how we work or share your hiring need.