Risk Analyst

Senior OT Risk Assessment Analyst – Energy & Critical Infrastructure We are looking for a Senior OT Risk Assessment Analyst to plan and drive an end-to-end OT cyber and operational risk assessment across complex industrial environments in the energy sector. The purpose is to establish a complete and consistent picture of the operational and security risks the organisation carries today, including risks that are not yet identified or documented, so that management and engineering can make informed decisions and design fit-for-purpose security solutions. This is not primarily an IT/GRC risk role. You must have enough OT and industrial understanding to determine how technical weaknesses, failures or compromises translate into operational and business risk. Responsibilities

• Plan, structure and drive OT cyber and operational risk identification and assessments, including identification of unknown or undocumented risks
• Apply IEC 62443, in particular IEC 62443-3-2: risk assessment, zones and conduits, threat scenarios and Target Security Levels (SL-T), and translate risks into security requirements and treatments
• Assess asset and system criticality, threats, vulnerabilities, likelihood, operational consequences, inherent and residual risk, and appropriate treatments
• Analyse OT architectures and dependencies, including zones, conduits, trust boundaries, critical data flows, remote and vendor access, and dependencies on IT, OEMs and external services
• Lead structured risk-identification workshops with Technical Authorities, Engineering, Operations, Security and asset/system owners, using strong facilitation skills to challenge assumptions and uncover hidden risks
• Assess risk in its operational and business context (availability, safety, production, environment, maintainability, regulatory impact), not technical severity alone
• Consolidate findings into a portfolio-level OT risk picture, identifying systemic risks, concentrations and recurring themes
• Mature OT risk registers and risk-management processes: consistent risk statements, ratings, ownership, traceability, prioritisation and management reporting
• Translate prioritised risks into risk-treatment requirements and high-level solution scopes to support risk-based decisions and subsequent engineering activities

Requirements Must have

• Strong, practical experience with OT/ICS security and industrial risk assessment
• Demonstrated practical knowledge of IEC 62443, particularly IEC 62443-3-2
• Practical experience with ISO/IEC 27001-family risk management, particularly ISO/IEC 27005
• Strong OT/industrial domain knowledge: SCADA, PLCs, HMIs, engineering workstations, OT networks, remote/vendor connectivity, legacy/EOL technology
• Experience applying risk management in industrial/OT environments, not solely traditional IT/GRC
• Experience facilitating workshops with engineering, operations and security stakeholders
• Experience maturing risk registers and reporting risk to management
• BSc/MSc in Cyber Security, Automation/Control, Electrical or Industrial Engineering, Risk Management or a related field, or equivalent senior professional experience
• Fluent English

Nice to have

• IEC 62443 training or certification
• ISO/IEC 27001 and/or 27005 training, certification or recognised risk-management qualification
• Experience with ISO/IEC 27019 in the energy/utility sector
• GICSP, CISSP, CISM, CRISC or comparable certification
• Experience from energy, utilities, renewables or comparable critical infrastructure