OT Cybersecurity Engineer

The Company The energy industry is entering one of the most significant periods of growth and transformation in its history. Meeting the nation’s growing demand for reliable electricity will require new ideas, new infrastructure, and talented people committed to building for the future. At Cypress Creek Energy, we’re meeting that challenge by developing and operating the energy infrastructure needed to power communities, support economic opportunity, and strengthen resilience. We believe our responsibility extends beyond the grid and that how we build matters just as much as what we build. That same commitment extends to our employees. We invest in professional growth, encourage collaboration across teams, and provide opportunities to take ownership, expand your expertise, and advance your career. Our culture is grounded in safety, accountability, respect, and a shared commitment to deliver results. Join us and help meet one of the most important energy challenges of our time while building a rewarding career. Overview Cypress Creek is looking for an OT Cybersecurity Engineer to protect the SCADA and operational technology systems that monitor and control our generation sites. You will main tain OT systems by keep ing them patched, protected from malware, monitored for intrusions , ensuring re sil iency , and you will work with the SCADA team, IT, and vendors to do it without disrupting operations. Responsibilities Patch and vulnerability management Track vendor advisories and vulnerabilities for OT assets, including SCADA servers, HMIs, historians, RTUs/PLCs, firewalls, switches, routers, and cellular gateways. Test and schedule patches with vendors and site teams. Document approvals, maintenance windows, rollback plans, and exceptions. Run vulnerability scans, prioritize findings by risk, and track remediation to closure. Report on patch compliance and open vulnerabilities across sites. Antivirus and endpoint protection Deploy and manage antivirus and endpoint protection on OT-appropriate Windows and Linux hosts, including scan schedules and exclusions that will not disrupt control systems. Review detections, investigate suspicious activity, and remediate infected or at-risk systems. Manage removable media and transient asset controls for vendor and field laptops. Network intrusion detection and incident response Monitor OT network traffic with intrusion detection and monitoring tools such as Dragos, Zeek, Snort, or similar, and tune rules to reduce false positives. Triage and investigate alerts in the SIEM, determine scope and impact, and escalate or contain as needed. Maintain and test incident response plans, including tabletop exercises with IT, operations, and vendors. Review firewall logs, VPN activity, and remote access for anomalies. Vulnerab ility Assess ment s Plan and perform active vulnerability assessments of OT assets during approved maintenance windows, using validated scanning methods that minimize operational risk . . C onduct passive vulnerability assessments using network monitoring, asset discovery, configuration reviews, and available threat intelligence without disrupting control-system operations. Analyze and prioritize assessment findings based on exploitability, asset criticality, operational impact, and applicable OT cybersecurity requirements. Develop mitigation and remediation plans with asset owners, operations, IT/OT, and vendors; validate corrective actions and track findings through closure or documented risk acceptance. Coordinate with third-party assessors on external vulnerability assessments, including defining scope and rules of engagement, facilitating access, reviewing results, and managing follow-up actions. Resiliency and dis as ter r e covery Develop and maintain site-specific OT disaster recovery procedures, including system dependencies, restoration priorities, recovery time and recovery point objectives, and vendor contacts. Maintain and monitor secure backups of SCADA servers, HMIs, historians, controller programs, and network device configurations, including offline or immutable copies Perform scheduled backup restoration and disaster recovery exercises with operations, IT/OT, and vendors; document results, verify data integrity, and track corrective actions to closure. <span data-ccp-props="{"201341983":0,"335559685":360,