Skip to main content
Zylarity

Industry Intelligence / Hiring guidance

Hiring for critical OT environments starts with the right questions.

An OT security title rarely tells the whole story. Two employers can advertise the same title while needing very different people. Start with the operating responsibility, then examine the experience that supports it.

01 / The role

Name the decisions the person will own.

Will they design segmentation, maintain asset visibility, lead incident coordination or build a program across sites? Identify what they can change directly, what requires an operations partner and what must be escalated. Add the practical constraints: location, travel, on-call expectations, compensation and access to facilities.

02 / The talent

Explore experience in its original context.

A tool name is a starting point for a conversation. Ask what the professional personally did, where they did it, what constraints shaped the decision and how the result was understood. Distinguish hands-on ownership from participation, and demonstrated evidence from information still to be checked.

03 / The match

Make the unknowns useful.

A good shortlist explains both the fit and the questions that remain. A candidate may bring strong architecture experience but need a conversation about plant access or travel. Another may know the environment well but need deeper technical evaluation. Those are specific next steps, not reasons to hide uncertainty behind a score.

Three questions for an OT hire

Before you open the search

Write down five things:

  1. The operating environment: systems, sites and safety or availability constraints.
  2. The responsibility: decisions the person owns and where operations must be involved.
  3. The evidence: work they should be able to explain or demonstrate.
  4. The practical fit: location, travel, on-call expectations and compensation.
  5. The first outcome: what should be different after 90 days.

You do not need a finished job description to start this conversation.

Turn a broad requirement into a useful interview question.

Broad requirement:
Experience with OT network segmentation.
Clearer requirement:
Design OT network segmentation that preserves required plant communications and approved support access.
Interview question:
Walk us through a segmentation change you worked on. Which traffic needed to cross the boundary, who approved those connections, and how did you test the rules and rollback plan?
What to listen for:
What the person personally owned and how the operating constraints changed the plan.

Regulation can sharpen the brief.

In the United States, for organizations in scope, NERC's Critical Infrastructure Protection (CIP) standards address Cybersecurity for the bulk power system under FERC oversight. For a role supporting this work, identify the systems in scope and the responsibilities the person will own. Confirm which requirements apply before turning a compliance obligation into a hiring requirement.

Source: FERC, Cyber and Grid Security.

In the European Union, for organizations in scope, NIS2-related work can require clear responsibilities and appropriate Cybersecurity skills. ENISA maps obligations to role profiles and tasks, including staffing and skills development. A recruitment decision can support that work; hiring a particular job title does not itself establish compliance.

Source: ENISA, Cybersecurity roles and skills for NIS2 Essential and Important Entities.

See an example OT role profile

Need help shaping a role? Discuss Your Needs