OT Security Engineer

We are a $13+ billion global technology company, home to more than 224,000 people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud, and AI, powered by a broad portfolio of technology services and products.

HCLTech is a globally recognized leader in the Tech and IT industry, but we’ve never forgotten the startup mindset that got us here. We’ve always approached our work with an idea-first attitude because every one of our accomplishments —no matter how big or small —can be traced back to an idea’s single spark.

It’s that spark —that inner drive —that sets our people apart from our competitors. It enables us not just to pull off game-changing feat after game-changing feat but to better our world in the process. We want you to find your spark. Because that’s what drives you to be better, be more and ultimately, be more fulfilled.

Role- OT Security Engineer with Nozomi experince

Location- Coventry, UK

Job Type- Hybrid (3 days per week)

Employment type- Fixed term contract (11 months Duration)

Job Description — OT Security Engineer (OT/ICS IDS Sensor Deployment, Multi-Site)

Role summary

We are recruiting an OT Security Engineer to lead the physical deployment, commissioning and onboarding of OT/ICS network monitoring (intrusion detection) sensors across multiple operational sites. These passive sensors provide asset discovery, network visualization, vulnerability assessment and threat/anomaly detection, feeding their data to a central management platform (on-premises and/or cloud-hosted).

The role is hands-on and field-based: racking and cabling physical sensor appliances, configuring monitoring sources (SPAN/TAP/mirror), establishing and validating the connection from each sensor to the central/cloud management platform, provisioning licenses, and confirming that assets, alerts and data ingestion are healthy at each site. You will work closely with site engineering, network and OT operations teams, and follow strict OT change-control and safety practices throughout.

This role suits an engineer who combines OT/ICS networking knowledge with practical experience of an OT monitoring/IDS platform and enjoys structured, multi-site rollout delivery in a critical-infrastructure environment.

Key responsibilities

• Plan and execute the physical installation of OT monitoring/IDS sensor appliances at multiple sites: racking, power, structured cabling, copper/fibre and SFP selection.
• Conduct or review site surveys to confirm rack space, power, monitoring source (SPAN/TAP/mirror-port) availability and network paths before deployment.
• Configure sensor monitoring interfaces and validate that the correct traffic is being captured from the target OT network segments.
• Establish and validate the connection from each sensor to the central/cloud management platform (management URL/endpoint, enrolment token/credentials), and confirm successful synchronization.
• Provision and validate licensing/entitlement for each sensor (including confirming assets fall within the licensed tier) and resolve licensing/entitlement issues with the platform team/vendor.
• Coordinate network and firewall changes (e.g. required outbound connectivity, DNS, NTP, certificate trust) so each site's sensor can reach its management platform.
• Validate post-deployment health: asset discovery/inventory, alert generation and routing, integration data flow (e.g. SIEM/log pipeline), data ingestion and overall sensor health.
• Support sensor migration, replacement and refresh activities, including repointing sensors to a new platform/tenant, physical swap of appliances where remote access is unavailable, and re-enrolment/rotation of units.
• Troubleshoot connectivity, licensing, data-visibility and performance issues, escalating to the vendor with appropriate diagnostic detail when required.
• Produce and maintain deployment documentation: site as-builts, runbooks, checklists, change records and handover packs to operations.

Required skills (technical)

• OT monitoring / IDS platform — hands-on experience deploying and administering at least one OT/ICS network monitoring or intrusion-detection platform (physical sensor appliances plus central/cloud management), and onboarding, licensing and validating sensors.
• OT/ICS networking — solid understanding of the Purdue model, network segmentation/zoning, VLANs, switching, and passive monitoring via SPAN/TAP/mirror ports.
• Networking fundamentals — TCP/IP, DNS, NTP, routing, and firewall rule design; ability to specify and verify the connectivity a sensor needs to reach its management platform.
• Linux / appliance CLI — comfortable operating on a Linux-based sensor OS for configuration, diagnostics and troubleshooting.
• Industrial protocols — working familiarity with common OT protocols (e.g. Modbus, DNP3, IEC 60870-5-104, IEC 61850, EtherNet/IP, PROFINET, S7, OPC/OPC-UA) and the devices that use them (PLCs, RTUs, DCS, HMIs).
• Physical hardware — appliance racking, cabling, power, and fibre/copper/SFP handling in data-centre and industrial site environments.
• Documentation — clear as-builts, runbooks and change records suitable for audit and BAU handover.

Required experience

• [5]+ years in OT/ICS security, industrial networking, or a closely related field.
• Demonstrable hands-on experience deploying an OT monitoring/IDS platform in production environments (e.g. Nozomi Networks, Claroty, Dragos, Armis, Forescout, Tenable OT, Microsoft Defender for IoT, Cisco Cyber Vision, or similar).

Certifications

Required (or willingness to obtain within an agreed period):

• Vendor certification for the deployed OT monitoring/IDS platform — e.g. Nozomi Networks Certified Engineer (NNCE), Claroty, Dragos, Armis, or the equivalent for the platform in use.
• and/or a recognized OT/ICS security credential Strongly desirable:
• Networking: Cisco CCNA (or CCNP); vendor-neutral CompTIA Network+.
• Security foundation: CompTIA Security+.
• Advanced/vendor troubleshooting certification for the platform in use.

Nice to have:

• GIAC GRID / GCIP (ICS defense / critical infrastructure protection).
• Firewall/network vendor certifications relevant to the site estate (e.g. Cisco, Fortinet, Palo Alto).
• OEM/ICS platform familiarity (e.g. Schneider Electric, Siemens, Rockwell, Mitsubishi/MELSEC).

Behavioral / soft skills

• Methodical and safety-conscious, with strong attention to detail in high-consequence environments.
• Clear communicator who can work with both OT operations staff and IT/security teams.
• Self-directed on site, able to solve problems independently and know when to escalate.

Working conditions

• Regular travel to operational sites, some of which may be remote or have restricted access.
• Work in data-centre and industrial environments (control rooms, plant rooms, substations, etc.), observing site safety, PPE and permit-to-work requirements.
• Some activity within scheduled maintenance windows, which may fall outside standard hours.
• May require security vetting and site-specific inductions.

What success looks like (first 3–6 months)

• Sensor appliances deployed and commissioned across the target sites to plan.
• Every sensor connected to its management platform, correctly licensed, and confirmed healthy (assets, alerts, ingestion).
• Site documentation and runbooks completed and handed over to operations.
• Repeatable, low-risk deployment process established for remaining/future sites.