One OT Security Team, Multiple Plants: What Should Be Central and What Should Be Local?
A central OT security team can see problems shared across the business. Plant personnel understand the equipment, schedules and working relationships at their site. Your staffing plan needs to connect those perspectives on the decisions people make every week.
Start with a few ordinary situations: a vendor needs access, monitoring finds unfamiliar activity, a project proposes a network change. Follow each one from request to completion. The handoffs will show you where responsibilities are clear and where work is waiting for somebody to own it.
Allocate decisions before counting positions
A statement such as 'central security owns OT security' leaves many practical questions unresolved. Who checks the effect of a proposed change on production? Who coordinates the maintenance window? Who decides whether an exception is acceptable? The central team may support all three activities while holding authority for only some of them.
Create a responsibility map with the people who actually do the work. Include security, engineering, operations and any relevant service provider. For each recurring activity, name the person who coordinates it, the people who contribute and the person who approves the decision. Give each responsibility a backup for absences.
Keep the map small enough to use. If it takes a committee meeting to work out who should respond to a routine request, the organization chart has not yet solved the operating problem.
A starting point for the discussion
This is a planning example. The allocation should follow your operating model and formal authority. A large site with substantial engineering staff may own work that a smaller facility receives from a regional team. Record those differences so a shared policy does not conceal different staffing needs.
| Work | Possible central responsibility | Possible plant responsibility |
|---|---|---|
| Security standards | Maintain requirements and coordinate specialist review. | Explain local constraints and raise exceptions needing a decision. |
| Monitoring findings | Review observations and coordinate security investigation. | Provide process context and arrange local technical support. |
| Planned changes | Review the security design and shared dependencies. | Coordinate operational approval, timing and site execution. |
| Incident preparation | Maintain cross-site coordination and specialist contacts. | Maintain local response contacts and operating procedures. |
Three plants can create three different jobs
Imagine a manufacturer with a mature plant, a recently acquired facility and a new production line under construction. The mature site needs steady support. The acquisition needs discovery and relationship building. The new line needs involvement in project decisions and handover. Counting them as three identical sites hides the workload.
For each location, list planned projects, recurring responsibilities and work requiring physical presence. Include the travel time and preparation involved. Then identify which activities can share a central specialist and which need a reliable local counterpart.
If one engineer is expected to cover all three, resolve scheduling conflicts before advertising the role. Two sites may need the same person during overlapping maintenance windows. Decide who can provide backup and what work can be postponed. Put the resulting travel and availability expectations in the hiring brief.
Hire for the missing connection
A company with capable plant engineers may need a central OT security lead who can set priorities and coordinate work across sites. Another may have strong central design expertise but need a site engineer who can carry approved work through implementation. Those searches require different evidence from candidates.
Ask applicants about a disagreement between a central team and an operating site. What did they need to understand? How did they get a decision? What responsibility did they keep afterward? The account helps you assess whether they can work through the relationships your position depends on.
Review the responsibility map after the person joins and whenever the site portfolio changes. Watch for work repeatedly sent back between teams or completed only because one helpful person takes it on. Those are specific staffing questions you can address before the next vacancy is posted.
Describe the sites, the existing team and the work that needs an owner. We can help shape the role you need to recruit.
Start Your Hiring Brief