Overview

Incident Response Playbook Consultant – Operational Technology (OT) Focus

We are seeking an experienced Incident Response Playbook Consultant with a strong focus on Operational Technology (OT) security. This is an 8-month contract role, offering a unique opportunity to work within a major industrial organisation operating at scale across critical sectors such as construction, cement, and manufacturing. The successful candidate will play a pivotal role in enhancing cyber resilience within OT environments, ensuring robust response strategies to mitigate and manage cyber threats effectively.

Background & Context:
In today’s increasingly interconnected industrial landscape, cyber threats targeting OT environments are growing in sophistication and impact. Industrial sectors such as construction and manufacturing rely heavily on ICS (Industrial Control Systems), SCADA (Supervisory Control and Data Acquisition) systems, and other OT technologies, making them attractive targets for cyber adversaries. Ensuring operational continuity while responding to ransomware attacks, insider threats, and Advanced Persistent Threats (APTs) is critical. This role is designed to bolster incident response preparedness, integrating IT and OT cybersecurity measures to create a cohesive and actionable response framework.

Key Responsibilities:

  • Develop and author tailored incident response playbooks for OT environments, ensuring they address sector-specific cyber risks and operational constraints.
  • Collaborate with cybersecurity teams, operational engineers, and risk management professionals to ensure playbooks are realistic, effective, and actionable.
  • Align playbooks with industry standards and frameworks, including NIST CSF, ISA/IEC 62443, MITRE ATT&CK for ICS, and relevant regulatory requirements.
  • Work closely with Security Operations Centres (SOCs) and Incident Response teams to validate and refine response procedures through real-world attack scenario simulations.
  • Develop structured response workflows, escalation paths, and decision trees for handling threats such as ransomware, supply chain attacks, and sophisticated persistent threats.
  • Define containment and eradication procedures that balance operational continuity, safety considerations, and regulatory compliance.
  • Establish reporting templates and documentation aligned with industry and regulatory expectations for effective post-incident analysis and compliance.
  • Assist in tabletop exercises and simulation testing, refining playbooks based on feedback, evolving threat landscapes, and lessons learned from past incidents.
  • Ensure seamless IT & OT incident response integration, fostering collaboration between traditional IT security teams and OT operational units.
  • Provide training and awareness sessions for OT personnel, empowering them to recognize, respond to, and escalate cyber incidents effectively.
  • Collaborate with the OT team on related NIST Programme initiatives to enhance overall cybersecurity maturity within the organisation.

Candidate Profile:
The ideal candidate will have a deep understanding of industrial cybersecurity threats, incident response methodologies, and the unique challenges of securing OT environments. Experience working within critical infrastructure, manufacturing, or large-scale industrial sectors is highly desirable. The ability to communicate effectively with both technical security teams and operational staff is essential.

Required Skills & Experience:

  • Proven experience in developing and implementing incident response playbooks for OT environments.
  • Strong knowledge of OT cybersecurity frameworks such as ISA/IEC 62443, NIST CSF, MITRE ATT&CK for ICS.
  • Experience working with SOCs and Incident Response teams, particularly in OT-focused cybersecurity incidents.
  • Understanding of ICS/SCADA security challenges, including network segmentation, monitoring, and secure remote access.
  • Familiarity with threat actors targeting OT environments, including ransomware groups and nation-state adversaries.
  • Ability to balance cybersecurity best practices with operational requirements, ensuring minimal disruption to industrial processes.
  • Experience conducting tabletop exercises, simulations, and cybersecurity training for OT personnel.
  • Excellent documentation and reporting skills, with an emphasis on regulatory compliance and audit readiness.
  • Strong communication and collaboration skills to work across multi-disciplinary teams, including engineers, risk managers, and security professionals.

Contract Details:

  • Duration: Until the end of the year (8 months)
  • Rate & IR35 Status: Ask consultant

This is an excellent opportunity for a cybersecurity professional with deep OT expertise to contribute to a large-scale industrial security programme. If you have a passion for enhancing cyber resilience in critical infrastructure environments, we’d love to hear from you.