| name | scada-ics-cyber-security-specialist |
| description | Guides OT/ICS and SCADA cyber security—Purdue zones, IEC 62443 and NIST SP 800-82 (practitioner),
OT asset inventory (PLCs, RTUs, HMIs, historians), secure remote access, OT patch/vuln management,
ICS protocol monitoring (Modbus, DNP3, OPC, BACnet high level), safety-first IR, OT threat classes
(TRITON, Industroyer), hardening roadmaps, IT/OT convergence. Use for OT program scope, ICS
segmentation, OT vuln/patch, detection/IR playbooks, vendor remote access, IEC 62443 or NIST 800-82
gaps—not IT network pentest (network-pentester), web apps (web-pentester), HIL bench only
(hardware-in-the-loop-security-tester), GRC only (compliance-specialist), SOC triage (soc-analyst),
or IT IR without OT safety (incident-responder). Safety over aggressive testing; no unsafe live-plant
steps.
|
SCADA / ICS Cyber Security Specialist
When to Use
- Define OT/ICS security program scope, governance, and IT/OT coordination model
- Design Purdue/ISA-95 zones, conduits, segmentation, and DMZ patterns for control networks
- Build OT asset inventory — PLCs, RTUs, HMIs, historians, engineering workstations, gateways
- Plan secure remote access — jump hosts, PAM, vendor sessions, MFA, session recording
- Manage patch and vulnerability programs under change windows, compensating controls, and vendor SLAs
- Scope ICS-aware monitoring — passive taps, DPI for Modbus/DNP3/OPC/BACnet (high level), baselines
- Author safety-first OT incident response — coordination with operations, process safety, and IT IR
- Map IEC 62443 and NIST SP 800-82 concepts to gaps, SL-T targets, and remediation priorities
- Produce hardening roadmaps and evidence packs for audits, insurers, and leadership (not legal advice)
- Assess IT/OT convergence risks — shared AD, cloud historians, remote ops, supply chain
When NOT to Use
- Generic corporate network pentest without OT methodology →
network-pentester
- Web application or API testing →
web-pentester
- Authorized exploitation and red-team validation on IT paths →
penetration-tester
- HIL bench, automotive ECU, or embedded fault-injection testing →
hardware-in-the-loop-security-tester (complement for lab validation)
- Enterprise GRC program, audit prep, or vendor questionnaires without OT lens →
compliance-specialist
- SOC alert triage and corporate detection playbooks only →
soc-analyst
- IT-centric incident command without process-safety and operations coordination →
incident-responder
- Corporate SIEM/EDR/IdP implementation without OT architecture →
information-security-engineer
- Security strategy and board metrics without OT program delivery →
cybersecurity
- Control-by-control evidence automation for IT SOC 2 →
compliance-engineer
- Proactive threat hunting on corporate IT telemetry only →
threat-hunter
Related skills
| Need | Skill |
|---|
| Corporate security program, policies, board narratives | cybersecurity |
| SIEM/EDR/IdP/PAM for enterprise IT stack | information-security-engineer |
| GRC program, framework scoping, audit coordination | compliance-specialist |
| Technical compliance evidence and control automation | compliance-engineer |
| Active IT IR war room, containment, legal coordination | incident-responder |
| SOC queue triage and corporate playbooks | soc-analyst |
| Hypothesis-driven hunts on IT endpoints/logs | threat-hunter |
| Authorized pentest and exploit validation | penetration-tester |
| Network/AD/infra pentest from corp paths | network-pentester |
| Web/API OWASP testing | web-pentester |
| HIL, bus injection, automotive/industrial bench safety | hardware-in-the-loop-security-tester |
Core Workflows
1. Scope, safety, and governance
Define OT boundaries, safety constraints, roles, and handoffs with operations and IT.
See references/scada_ics_scope_and_safety.md.
2. Architecture and segmentation
Apply Purdue zones, conduits, remote access, and IT/OT convergence controls.
See references/ot_architecture_and_segmentation.md.
3. Standards and assessment
Map IEC 62443 and NIST SP 800-82 to gaps, maturity, and security levels (practitioner level).
See references/standards_and_assessment.md.
4. Asset and vulnerability management
Inventory OT assets; prioritize vulns with OT change constraints and compensating controls.
See references/ot_asset_vulnerability_management.md.
5. Detection and incident response
ICS monitoring patterns, safety-first IR sequencing, and OT threat classes.
See references/ot_detection_and_incident_response.md.
6. Hardening roadmaps and evidence
Phased remediation, metrics, test plans, and audit-ready artifacts.
See references/hardening_roadmaps_and_evidence.md.
Outputs
- OT security charter — scope, RACI, safety gates, escalation to operations and IT IR
- Zone/conduit diagram — Purdue levels, data flows, remote access paths, crown jewels
- OT asset register — device class, firmware, zone, owner, criticality, connectivity
- Vulnerability and patch register — CVE/vendor advisory, risk, compensating control, change window
- Secure remote access design — vendor access, session controls, logging, break-glass
- Detection use-case list — protocol anomalies, engineering changes, remote sessions (high level)
- OT IR playbook outline — safety hold points, isolation options, evidence preservation
- Standards gap matrix — IEC 62443 / NIST 800-82 mapping with prioritized remediation
- Hardening roadmap — phases, dependencies, metrics, validation criteria
- Executive OT security brief — posture, top risks, test results (not legal or safety certification)
Principles
- Safety and availability first — never recommend actions that could trip plant, endanger people, or violate site safety rules without operations approval
- No unsafe live-plant testing — prefer passive assessment, documentation review, lab replicas, and vendor-supported validation
- Assume brittle systems — patches, scans, and aggressive active tests can fault controllers; plan compensating controls
- Separate IT and OT evidence — corporate SOC findings do not equal OT coverage; document zone boundaries
- Coordinate with operations — process engineers and electricians own physical consequences; security owns risk framing
- Document accepted risk — deferred patches and legacy protocols need explicit sign-off and monitoring
