Senior OT Cybersecurity Consultant

Rockwell Automation is a global technology leader focused on helping the world’s manufacturers be more productive, sustainable, and agile. With more than 28,000 employees who make the world better every day, we know we have something special. Behind our customers - amazing companies that help feed the world, provide life-saving medicine on a global scale, and focus on clean water and green mobility - our people are energized problem solvers that take pride in how the work we do changes the world for the better.

We welcome all makers, forward thinkers, and problem solvers who are looking for a place to do their best work. And if that’s you we would love to have you join us!

Job Description

About Kalypso | Rockwell Automation

Kalypso — a Rockwell Automation Business, guides clients through operational transformation using digital solutions, cybersecurity, networks, and cutting‑edge automation. We help define strategies, implement solutions, and achieve measurable results across complex IT/OT environments.

As an OT Cybersecurity Consulting Project Delivery Lead, you will shape our consulting strategy and services, then lead teams to deliver them at scale. You'll translate OT security needs into executable roadmaps, drive GRC governance and risk reduction, operationalize OT SOCs, and tie solution delivery of OT cybersecurity and infrastructure projects back to strategic outcomes and value. You will also be responsible for mentoring teams and partnering across sales, multiple Rockwell delivery business units and our partners to provide a seamless, high‑functioning go‑to‑market and delivery engine. You will report to the Digital Consulting, Senior Manager and have a remote schedule working out Wisconsin.

Your Responsibilities:

1) Delivery Leadership Across Cyber Consulting Capabilities

Governance, Risk & Compliance (Program & Policy)

• Lead maturity assessments and roadmaps aligned to NIST CSF, NIST SP 800‑82, and ISA/IEC 62443; define site‑to‑enterprise governance (charters, roles/RACI, KPIs/OKRs, ROSI, operating cadence).

• Establish policies, standards & procedures, incident response playbooks, business continuity, and compliance strategies (e.g., NIS2), tuned for OT realities (prioritizing safety & availability).

Asset & Vulnerability Management

• Direct asset inventory/visibility, vulnerability & patch management, hardening/allow‑listing, backup & restoration, and segmentation aligned to CPwE zones & conduits and iDMZ patterns.

• Develop and maintain collection planning for OT environments, ensuring telemetry, logging, and monitoring requirements are defined and prioritized to support detection, response, and compliance objectives.

• Guide secure remote access, identity for OT/AD, and zero‑trust patterns for control systems; oversee deployment of leading NDR/NIDS/EDR and logging/telemetry for plants and edge.

• Ensure solutions integrate with process safety and production constraints (turnarounds, batch windows, critical alarms), protecting availability and safety first—then integrity and confidentiality.

SOC Detection/Response

• Operationalize threat‑informed defense for OT using MITRE ATT&CK for ICS—map use cases, detections, and playbooks; design OT‑SOC operating models and integrate with SIEM/SOAR/MDR.

• Lead tabletop exercises and purple‑team drills across plants and enterprise SOC; translate intel into prioritized, risk‑based actions.

Technical Enablement & Delivery Infrastructure

• Consult on selection and integration planning for OT security platforms (e.g., NDR/NIDS/EDR, SIEM/SOAR, GRC), ensuring alignment with telemetry, logging, and monitoring requirements across plants and enterprise SOCs.

• Develop operating models and use cases for OT SOCs, secure remote access, and identity management; support clients in mapping detections, playbooks, and response workflows to business risk and operational constraints in on-prem, hybrid and cloud environments.

• Guide clients in interpreting endpoint, network, and cloud telemetry to inform detection, response, and compliance strategies across OT environments.

• Support use case development and automation planning through scripting and orchestration techniques (e.g., Python, PowerShell, Bash).

• Advise on integration of APIs, log sources, and telemetry pipelines with security platforms (e.g., EDR, NDR, DLP, CASB, MDM, vulnerability management) to enhance visibility and operational resilience.

2) Cross‑Functional Collaboration & Teaming

• Partner with Global Cyber Security Consulting Platform l