Hiring an OT security engineer: profile and interview

The OT security engineer is often the hardest seat to fill in an industrial cyber team. The role needs someone who speaks the language of automation engineers, knows network security inside out and can get production teams, for whom uptime comes first, to accept new controls. This guide helps you scope the role, pick the right background and run an interview that reveals how candidates actually behave.

What an OT security engineer does

The OT (or ICS, for industrial control systems) security engineer protects the systems that drive physical processes: PLCs, SCADA supervision, engineering workstations, HMIs and fieldbus networks. The job is not to copy office IT security onto the shop floor, but to adapt it to installations that must keep running.

The work usually falls into five areas:

Know the estate. Inventory devices, flows and access paths, often starting from incomplete documentation, without disrupting production.
Segment. Define zones and conduits, put filtering in place between business IT and industrial networks, then between industrial zones themselves.
Control access. Govern remote maintenance by integrators and vendors, shared accounts, engineering workstations and removable media.
Detect and respond. Run passive monitoring sensors, work with the SOC to triage alerts, and prepare incident response playbooks that are compatible with how the plant is operated.
Support projects. Write security requirements into specifications for new lines and review the architectures integrators propose.

For the wider picture (regulatory drivers, other roles an industrial company needs), see our article on cyber hiring in industry and OT.

Three backgrounds, three ways to succeed

Candidates who master automation, industrial networking and cybersecurity all at once do exist, but they are rare and heavily courted. Most successful hires start from one of the three backgrounds below, backed by a skills development plan.

Background	Strengths	What needs to be added	Good choice if
Automation or process engineer	Knows PLCs, processes and plant culture, credible with production	Network security, identity management, detection, risk analysis	Your plants are wary and trust is the first priority
Industrial network engineer	Architectures, fieldbus protocols, switching and filtering gear	Risk analysis methods, governance, incident response	Your priority is segmenting poorly separated sites
IT security engineer	Method, tooling, attacker knowledge, used to working with a SOC	Processes, uptime constraints, industrial protocols, field posture	You already have strong allies in production

Choose the focus based on your first workstream, not on an ideal. A site with no asset map and no segmentation will get more from an industrial network engineer than from a detection specialist. If you are unsure, our guide to hiring career changers helps assess the potential of someone coming from a neighbouring field.

Skills to check

The technical core

Whatever their background, an OT security engineer should be comfortable with:

layered industrial architectures (field, control, supervision, business) and how they map to zones and conduits;
the main industrial protocols and their design weaknesses, many of which have no authentication;
segmentation and filtering: firewalls, industrial DMZs, gateways;
remote access and privileged account management;
site-level risk analysis, in line with ANSSI guidance published on cyber.gouv.fr and the IEC 62443 series.

Hands-on experience with at least one major PLC family is a real plus. Demanding five vendors makes little sense: the ability to learn matters more.

Field posture

This is the criterion behind most failed hires. A strong candidate:

asks how the process works before suggesting a control;
says plainly they will not touch a device without operations signing off;
offers compensating controls when patching is not an option;
accepts trade-offs and documents them.

Communication

An OT security engineer talks to plant managers, maintenance leads, integrators and the CISO. They need to explain risk without jargon and defend a budget in production terms (downtime avoided, quality, people's safety).

Writing the job ad

A good OT job ad is concrete and honest. Spell out:

Scope: number of sites, types of processes, current maturity.
Reporting line: group CISO, industrial operations, or both. Candidates weigh this heavily.
First workstream: asset mapping, segmentation, remote access or detection.
Travel: how often, how long, and what can be done remotely.
Unusual hours: work during planned shutdowns, any on-call duty and how it is compensated.

Skip the list of twenty technologies. Name three or four must-haves and present the rest as what the role will teach. Our article on remote work and on-call duty helps you frame these sensitive topics.

Interview questions

The best questions start from real situations. Here is a selection, with what a good answer includes.

Scenarios

"You arrive at a site with no asset map. What do you do in the first three months?" Look for listening (meeting production and maintenance), a preference for passive monitoring over active scanning, and prioritisation by process criticality.
"A critical PLC runs on an unsupported operating system. Replacing it means a shutdown of several days." A good answer covers isolation, strict filtering, monitoring, restricted access and a medium-term replacement plan.
"A vendor insists on permanent remote maintenance access." Expect on-demand, logged, time-limited access through a single entry point, approved by the site.
"The detection sensor flags an unusual write to a PLC on a Sunday." The candidate should think of calling operations before acting, checking for planned work, and not cutting a flow without weighing the impact on the process.

Deeper questions

How would you explain the value of network segmentation to a plant manager?
How do you see the difference between functional safety and cybersecurity, and where do they meet?
Tell me about a disagreement with a production team or an integrator. How did you resolve it?

The practical exercise

A case study on a simplified plant diagram works very well: ask the candidate to draw zone boundaries, spot risky flows and prioritise three actions. To go further, a lab that reproduces a small industrial network lets you watch the candidate's method on simulated equipment, with no risk to your installations. Our article on structuring a technical cyber interview explains how to score these exercises consistently.

Mistakes to avoid

Hunting for a unicorn. Requiring expertise in automation, networking, detection and governance stretches the search with no guarantee.
Ignoring posture. A brilliant technician who alienates production teams will get nothing done on the ground.
Isolating the role. Without a link to the CISO and allies on each site, the engineer burns out carrying every topic alone.
Skipping onboarding. Plan weeks of on-site immersion alongside maintenance before the first recommendations.
Underestimating competition. Integrators, vendors and large manufacturers chase the same profiles. A slow process loses the best candidates, as our article on cyber time to hire explains.

In short

Hiring an OT security engineer starts with choosing a focus that fits your first workstream, then assessing field posture as closely as technical skill. An honest ad about sites, travel and reporting line attracts the right people. Scenarios close to your own shop floor reveal who can move security forward without stopping production.

Looking for an OT security engineer? At Cyber Recrut, a recruiter and a security practitioner scope the role with you and run the search together. Our shortlisted candidates prove their skills on hands-on labs close to your context. See how we work or share your hiring need.