OT Cybersecurity Operations Engineer

At Scatec, you get to work on something that matters. We develop, build, own, and operate renewable energy solutions that accelerate access to reliable and affordable clean energy. As part of a global and agile organisation, you will work with skilled colleagues across functions and geographies, take real ownership, and contribute to a company driven by the vision of improving our future. At the heart of everything we do is our belief that we bring the energy for change, connection, and growth. It shapes how we collaborate, innovate, and create impact together. If you are looking for a role where your contribution is visible, your development matters, and your work supports a more sustainable future, Scatec may be the right place for you.

Ready to make an impact?

As OT Cybersecurity Operations Engineer, you will own the operational health of Scatec’s OT monitoring and asset-management environment. You will keep the OT asset register accurate, ensure OT networks are monitored, and drive OT security alerts, vulnerabilities, configuration drift, and incidents through to closure. This is a global role with a strong operational focus, supporting reliable monitoring, data quality, platform availability, and effective incident management across Scatec’s OT landscape.

In this role, you will:

• →Triage alerts from the OT detection platform within agreed SLAs, classify severity, assign disposition, and drive each alert through the full incident lifecycle.
• →Separate genuine security events from process noise and provide tuning feedback to the detection platform owner.
• →Own the OT vulnerability register by mapping CVE findings to assets, assessing exploitability in context, and assigning risk ratings.
• →Follow up with OEMs and O&M contractors on patch availability, firmware validation, deployment windows, and closure of agreed actions.
• →Coordinate deployment windows with site O&M teams, verify post-change status, refresh baselines, and document compensating controls where patches are not available.
• →Support incident response by preserving evidence, providing asset and network context, and contributing to post-incident reviews.
• →Maintain the monitoring, asset-register, and configuration-management platforms, ensuring they are available, backed up, patched, licensed, documented, and supported by tested restore procedures.
• →Monitor platform availability, integration health, asset-register synchronisation, detection-platform exports, automated ticket creation, backup success, and data quality.
• →Manage network monitoring elements including device groups, monitoring templates, alert rules, escalation chains, distributed monitoring proxies, and version-controlled OT device templates.
• →Maintain asset-register data including sites, devices, interfaces, IP address space, VLANs, Purdue level, zones, and conduits.
• →Ensure configuration backup coverage, secure credential handling, configuration-diff alerting, and firmware repository management through the configuration-management platform.
• →Maintain a single authoritative OT asset register and ensure all other systems reconcile to it.
• →Review discovered devices weekly, classify them as expected, OEM-introduced, or unauthorised, and escalate unauthorised assets immediately.
• →Run monthly reconciliation across the asset register, detection platform, monitoring platform, and configuration-management platform, and drive every exception to closure.
• →Reconcile configuration drift against approved OT change requests, refresh baselines after approved changes, support compliance evidence for IEC 62443, NIS2, and ISO 27001 controls, and contribute to monthly operational reporting.

Your work will help strengthen Scatec’s OT cybersecurity operations, improve visibility across critical infrastructure, and ensure alerts, vulnerabilities, and configuration changes are managed with clear ownership and discipline.

• Global exposure to OT cybersecurity operations across renewable energy assets.
• Hands-on responsibility for monitoring, asset register, vulnerability, and configuration-management processes.
• The opportunity to work closely with IT Operations, Cybersecurity, plant teams, EPC project teams, OEMs, and O&M contractors.
• A role where operational ownership, reliability, and data quality directly support secure and resilient plant operations.

• Bachelor’s degree in IT, Engineering, Communication Networks, or a similar field.
• 3–5 years’ experience in network or infrastructure operations, including at least 2 years in industrial, utility, or critical-infrastructure environments.
• Relevant certification such as GICSP, ISA/IEC 62443, CCNA, or similar is preferred.
• Familiarity with OT security frameworks and regulations such as IEC 62443, NIST CSF, and NIS2.
• Experience in security incident triage, vulnerability management, and operational follow-up until closure.
• Strong monitoring fundamentals, including SNMP v2c/v3, ICMP, syslog, and agent-based monitoring.
• Hands-on experience building monitoring templates, alert rules, and escalation chains in enterprise network monitoring systems.
• Solid Linux server administration and container experience, including Docker.
• Strong IP networking knowledge, scripting experience in Python, Bash, or PowerShell, REST API integration, DCIM/IPAM or CMDB practice, and packet/network troubleshooting skills such as Wireshark or PCAP analysis.

At Scatec, we combine purpose with performance. We value responsibility, clarity, and collaboration, and we encourage people to challenge existing ways of working, contribute ideas, and keep developing. You can expect an environment where people work together across disciplines and geographies, where good performance matters, and where you are trusted to take ownership without unnecessary hierarchy.