For employers · OT hiring & security

Your job description could be an attacker’s next lead.

You wrote it to strengthen your defenses. Does it also tell an attacker which tools are protecting your plant?

Zylarity · September 26, 2026

A job description is written for candidates. It is also public information. When it names the exact platforms running in your operational technology environment, it can hand someone else a useful piece of reconnaissance: a clue about what you use, where to investigate and which newly disclosed vulnerability might matter.

That makes the public job posting an overlooked security decision. Hiring managers, internal talent teams and recruiting partners all need to ask the same question: does this detail help someone understand the work, or does it unnecessarily identify our environment?

They may be looking for a product before they are looking for you.

An attacker does not need to start with your company’s name. A newly disclosed vulnerability can give them a different starting point: find organizations that may use the affected product. A public job advertisement can help connect that product to an employer.

The National Vulnerability Database (NVD), maintained by the National Institute of Standards and Technology (NIST), is one public source of vulnerability information. Vendor advisories and other disclosures are also available to defenders and attackers alike. Separately, CISA has documented threat actors rapidly exploiting newly public vulnerabilities. That advisory does not attribute an intrusion to a job ad; it shows why the time between disclosure and an attack can be short.

Imagine that “OT Scanner 3000” requirement sitting on a job board for weeks, perhaps months. One morning, a critical vulnerability in that fictional product becomes public. An attacker researching potential users finds your listing. You may never have been on their radar. Now there is a reason to take a closer look.

The job ad intended to bring in another defender has also advertised a possible avenue of investigation. If the search is still stalled, the capability you wanted to add is still missing. It is the hiring equivalent of giving the opposition a clearer shot at goal while you are still recruiting the reinforcement.

A vacancy does not mean nobody is defending your environment. Nor does a product name prove you run an affected version or expose it to an attacker. But neither fact makes unnecessary disclosure useful.

What 10.0 means: A CVSS base score describes vulnerability severity. In CVSS v3.x and v4.0, 9.0–10.0 is Critical. A score does not establish that exploit code exists, that attacks are occurring or that your deployment is vulnerable. NIST explains the scoring and its limits.

Write for the capability. Keep the stack out of the advertisement.

Platform agnostic does not mean technically vague. You can describe asset visibility, industrial network monitoring, alert investigation and safe remediation without publishing a shopping list of deployed products. The requirement should tell a qualified person what they must be able to do.

Validate any essential platform experience later in a controlled hiring conversation. Keep product versions, site architecture, access arrangements and known control gaps out of the public brief. Where an exact product is genuinely central to the role, agree what needs to be shared, with whom and at which stage.

A stalled search leaves more than a vacancy.

A generalist recruiter or internal hiring team may recognize the product keywords without recognizing the OT disclosure risk. They may also overlook a strong practitioner whose experience transfers from another platform. Searching for a brand name can narrow the shortlist without telling you who can actually do the work.

If a traditional search stalls for weeks or stretches into months, your capability gap stays open longer and the public clue remains available longer. An OT specialist can challenge unnecessary product requirements and assess the underlying experience. Timing still depends on role scope, compensation, location and hiring decisions.

Before the next posting goes live

1. Define the outcome. State what the person will own, improve and decide.
2. Translate the platform. Replace installed-product names with the capabilities and operating experience required.
3. Review the disclosure. Have the hiring manager and OT security lead check the public brief, including copies sent to recruiters and job boards.
4. Control the detail. Agree when sensitive technical context is necessary for candidate evaluation.
5. Close the loop. Retire filled or withdrawn listings and request updates to syndicated copies. Do not assume removal erases cached or archived versions.

This is information discipline alongside patching, segmentation, access control and monitoring. Removing a product name does not remove a vulnerability or make a system secure. It reduces an avoidable clue.