Manager - Controls & Instrumentation (OT Cybersecurity)

Petrofac is a leading international service provider to the energy industry, with a diverse client portfolio including many of the world’s leading energy companies.

We design, build, manage and maintain infrastructure for our clients. We recruit, reward, and develop our people based on merit regardless of race, nationality, religion, gender, age, sexual orientation, marital status or disability. We value our people and treat everyone who works for or with Petrofac fairly and without discrimination.

The world is re-thinking its energy supply and energy security needs, planning for a phased transition to alternative energy sources. We are here to help our clients meet these evolving energy needs.

This is an exciting time to join us on this journey.

We support flexible working requests and have adopted a hybrid approach for most of our office-based roles. We ask employees to be present in the office at least three days per week.

Are you ready to bring the right energy to Petrofac and help us deliver a better future for everyone?

JOB TITLE: Manager / Deputy Manager – ICSS/OT/IT Cyber Security

KEY RESPONSIBILITIES:

·Responsible for procurement related activities such as preparation of Inquiry Requisition, participate in Technical Evaluation of vendor offers, Purchase Requisitions, Preparation and providing guidance on Technical Bid Evaluations and Vendor Document Reviews.

·Review the ITB (Invitation to Bid) documents submitted in the proposals stage, Contract documents, issue inquiry requisitions, review techno-commercial vendor offers, prepare equipment, material, and man-hour estimates.

·Responsible for leading Overall OT/IT cyber security for major ICSS (Integrated Control and Safety System) OT projects.

·Responsible for developing Cyber Security Plan for the project and approval from Client.

·Reviewing network architectures and determining if good practices are being followed (e.g., the “zones & conduits” concept, proper network segmentation, use of Industrial DMZ, etc.); and providing recommendations to comply with applicable cybersecurity framework.

·Reviewing security products utilized (e.g., firewalls, IDS, IPS) and determining if they are configured properly.

·Monitor deployment of network infrastructure devices (e.g., switches, routers, etc.), security appliances (e.g., firewalls, IDS, etc.), and virtualization solutions

·Reviewing security policies, plans, and procedures; assessing network monitoring capabilities; analyzing system logs, security events, and packet captures to identify security threats; and providing recommendations to comply with applicable cybersecurity framework.

·Lead design reviews/workshops, preparation of required EPC phase deliverables, Lead interfaces with various Package Vendors, prepare gap analysis against the project requirements for various control systems supplied by package vendors.

·Responsible for reviewing security products utilized (e.g., firewalls, IDS, IPS) and determining if the proposed configuration meets Project requirement and Industry standards.

·Responsible to review security policies, plans, and procedures; assessing network monitoring capabilities; analyzing system logs, security events, and packet captures to identify security threats; and providing recommendations and work with ICSS (Integrated control and Safety Systems) vendor to comply with applicable cybersecurity framework.

·Review administrative, technical, and physical security controls proposed by ICSS Vendor and providing recommendations to mitigate the identified security risks.

• Participate and contribute to Cyber security workshops, vulnerability, and risk assessments with ICSS Vendors to identify security risks and threats (e.g., unsecure remote access points, suspicious remote connections, unauthorized devices on the network, etc.) and providing recommendation to remediate the identified issues, Prepare Report/Update/Maintain and coordinate with all parties to close out action points.
• Review/Comments vendor submitted detailed diagrams (e.g., network, cabling, server, rack, logical architecture, etc.), procedures, and plans (e.g., implementation, SAT, mitigation, etc.) as needed to support projects.
• Responsible to handle Technical Queries/issues from all stake holders, document review/approval of Automation & Package vendors, certification requirements if any, participate in regular meetings with vendors & Client/JV Partner,
• Responsible to lead and participate in ICSS cyber security test at ICSS and package Vendor test locations, Responsible to accept the test and signoff reports.
• Responsible for coordination with client, PMCs, consortium partners, subcontractors, other discipline engineers and Project team.
• Participating in cross-functional and inter-office meetings to provide design input to Engineering team.
• Proactively identify and mitigate technical risks during project stage.