Job ID: 12505
Location: Corpus Christi, Texas
Category: IT
Employment Type: Direct Hire
Date Added: 10/02/2026
Job Description
Location: Corpus Christi, Tx
Description:
The OT Cybersecurity Technician is a hands-on, analytical role responsible for the daily health, monitoring, and continuous improvement of the OT cybersecurity tools protecting the Corpus Christi refinery's control systems. Beyond administering the platforms, the Technician actively analyzes system notifications, network activity, and firewall configurations, refines baselines, and makes documented recommendations based on company policies, procedures, and OT cybersecurity standards. The Technician works with the OT Cybersecurity Analyst, Automation staff, and Corporate Cybersecurity to turn newly surfaced data into actionable improvements.
Key Responsibilities:
Analysis and Recommendations:
- Analyze alerts and system notifications from Nozomi, SolarWinds, XONA, Octave/Hexagon Integrity, and Axway. Determine cause, operational relevance, and risk, and recommend corrective or preventive actions rather than only closing or escalating events.
- Monitor OT network and system activity for concerns such as unauthorized connections, unexpected protocol use, configuration changes, new or unknown assets, abnormal remote access, and failed authentication.
- Review firewall, switch, and remote access configurations against company policies, network segmentation standards, and approved communication paths. Identify unused, overly permissive, undocumented, or non-compliant rules, and recommend changes through Management of Change.
- Establish and continuously improve baselines for normal OT network traffic, device behavior, and user activity. Recommend alert tuning that reduces false positives without losing detection coverage.
- Support SIEM alignment as new data sources and event types come online. Recommend log sources, normalization, use cases, correlation rules, and escalation thresholds in coordination with Corporate Cybersecurity.
- Compare observed conditions to company OT cybersecurity policies, procedures, and the OT Cyber Incident Response Plan (OT CIRP). Identify gaps and recommend updates to procedures, standards, or controls.
- Summarize findings, trends, and recommendations in regular reports to the Automation Manager and OT Cybersecurity Analyst, separating confirmed findings from items that need further validation.
- Administer and maintain OT cybersecurity platforms. Perform routine health checks on sensors, collectors, servers, and integrations, and resolve data gaps, failed collections, and licensing or connectivity issues.
- Maintain accurate asset inventory, ownership, and criticality data, and reconcile inventory across platforms.
- Support vendor remote access sessions, user account provisioning and removal, and periodic access reviews.
- Support backup verification, patch staging, and vulnerability data collection in coordination with Automation.
- Escalate credible events per the OT CIRP and support incident response in the OT Cyber Support role.
- Maintain documentation, runbooks, and change records in accordance with Management of Change requirements.
- Provide first-line user support and help train Automation and Operations personnel.
- 5–10 years of experience in industrial automation, control systems, OT networking, or OT cybersecurity, including hands-on security monitoring or analysis.
- Direct experience in refining, petrochemical, chemical, power generation, oil & gas, or similar industrial operations.
- Working knowledge of DCS/PLC environments, industrial protocols (e.g., Modbus, OPC/OPC UA, EtherNet/IP), and Windows servers/workstations in OT.
- Experience reviewing firewall rule sets and network configurations (switches, VLANs, ACLs, remote access) against security policies and segmentation standards.
- Experience analyzing security alerts, logs, and network traffic to identify anomalies and develop practical recommendations.
- Working knowledge of SIEM concepts, including log sources, correlation, and alert tuning.
- Familiarity with ISA/IEC 62443, NIST CSF, and NIST SP 800-82.
- Strong written communication and disciplined documentation habits.
- Valid TWIC (Transportation Worker Identification Credential) card at time of start.
- Ability to work safely on-site in an operating refinery.
- Associate or bachelor's degree in Instrumentation, Electronics, IT, Networking, Cybersecurity, or related field (equivalent experience accepted).
- Certifications such as GICSP, GRID, Security+, CySA+, Network+, or CCNA.
- Experience with Nozomi, SolarWinds, XONA, Industrial Defender/Integrity, or similar OT security tools.
- Experience with SIEM platforms such as Splunk, Microsoft Sentinel, or Google SecOps.
- Experience with Honeywell Experion/TPS, Emerson DeltaV, or Rockwell systems.
- Work is performed at an operating petroleum refinery. Candidates must follow company safety, PPE, permitting, and Management of Change requirements and be able to work in operating units, control rooms, and equipment rooms.
- This is a 100% on-site position at the Corpus Christi Refinery. Remote or hybrid work is not available.
- Candidates must pass company and contractor-agency background, drug, and safety screening.
- Normal schedule is day shift, Monday–Friday, with occasional after-hours or call-out support during incidents, outages, and turnarounds.
