Senior OT Risk Assessment Analyst

NES Fircroft are supporting a key energy client in Denmark, with a Senior OT Risk Assessment Analyst role.

This will be a 1 year contract, with the view of being extended longer term, and although the client would prefer the individual to be office based 2 days per week (Kolding, Southern Denmark), they will consider a remote candidate, if they are deemed suitable.

For this role, the candidate must have sufficient OT and industrial understanding to determine how technical weaknesses, failures or compromises translate into operational and business risk.
 
Responsibilities:

• Plan, structure and drive end-to-end OT cyber and operational risk identification and assessments across complex industrial environments, including identification of unknown or undocumented risks
• Apply IEC 62443, particularly IEC 62443-3-2, including risk assessment, zones and conduits, threat scenarios and Target Security Levels (SL-T), and translate identified risks into security requirements and treatments
• Assess asset/system criticality, threats, vulnerabilities, likelihood, operational consequences, inherent/residual risk and appropriate risk treatments
• Demonstrate strong OT/industrial domain knowledge, including SCADA, PLCs, HMIs, engineering workstations, OT networks, remote/vendor connectivity and legacy/EOL technology
• Analyse OT architectures and dependencies, including zones, conduits, trust boundaries, critical data flows and dependencies on IT, vendors/OEMs, remote access and external services
• Lead structured risk-identification workshops with TA2/TA3, Engineering, Operations, Security and asset/system owners, using strong facilitation skills to uncover undocumented risks and challenge assumptions
• Assess risk in its operational and business context, considering availability, safety, production, environment, maintainability and regulatory/compliance impact, rather than technical severity alone
• Consolidate individual findings into a consistent portfolio-level OT risk picture, identifying systemic risks, asset-specific risks, dependencies, concentrations and recurring risk themes
• Mature OT risk registers and risk-management processes, including consistent risk statements, ratings, ownership, traceability, prioritisation and management-level reporting across organisational boundaries
• Translate prioritised risks into risk-treatment requirements and high-level solution scopes, enabling management, Technical Authorities and Engineering to make informed, risk-based decisions and progress subsequent engineering activities

Skills required:

• Relevant technical/security education or equivalent senior professional experience
• Strong practical OT/ICS security and industrial risk-assessment experience
• Demonstrated practical knowledge of IEC 62443 and ISO/IEC 27001-family risk management, particularly IEC 62443-3-2 and ISO/IEC 27005
• Experience applying risk-management principles within industrial/OT environments, not solely traditional IT/GRC environments
• BSc/MSc in Cyber Security, Automation/Control Engineering, Electrical Engineering, Industrial Engineering, Risk Management or related discipline
• IEC 62443 training/certification
• ISO/IEC 27001 and/or ISO/IEC 27005 training, certification or recognised risk-management qualification
• Experience with ISO/IEC 27019 in the energy/utility sector. ISO describes ISO/IEC 27019:2024 specifically as information-security controls for the energy utility industry
• GICSP, CISSP, CISM, CRISC or comparable relevant professional certification
• Experience from energy, utilities, renewables or comparable critical infrastructure
• Fluent in English

With over 90 years' combined experience, NES Fircroft (NES) is proud to be the world's leading engineering staffing provider spanning the Oil & Gas, Power & Renewables, Chemicals, Construction & Infrastructure, Life Sciences, Mining and Manufacturing sectors worldwide. With more than 80 offices in 45 countries, we are able to provide our clients with the engineering and technical expertise they need, wherever and whenever it is needed. We offer contractors far more than a traditional recruitment service, supporting with everything from securing visas and work permits, to providing market-leading benefits packages and accommodation, ensuring they are safely and compliantly able to support our clients.