OT Cybersecurity Lead Consultant - Saudi Fortinet

Lead end-to-end OT cybersecurity consulting engagements, from initial discoveries through architecture definition and roadmap delivery

• Perform initial and detailed risk assessments for ICS environments to identify threat scenarios, crown jewels, and business-relevant risks
• Perform network architecture and system architecture reviews to provide a clear and comprehensive overview of the OT network and its components, understand its structure and functions, identify potential vulnerabilities, design gaps, and make informed decisions about its management and security.
• Conduct interview-based assessments with engineering, operations, IT, and safety stakeholders.
• Provide support in determining Target Security Levels (IEC 62443) per zones and conduits based on the threat modeling, operational impact, and asset criticality.
• Translating risk assessment findings into actionable technical requirements for engineering teams.
• Act as the trusted bridge between CISOs, engineering leaders, and plant operations, translating cyber risk into operational impact and vice versa.
• Support Sales teams by contributing to RFPs, statements of work, and service scoping for OT/ICS cybersecurity engagements.
• Support programs aimed at growing OT enabled Services partners per Fortinet professional services framework.

Technical Skills & Knowledge

• Ability to design OT security architectures that prioritize availability, safety, and recoverability over pure prevention
• Ability to understand ICS/OT network architectures, regardless of the technology, and perform a detailed technical review.
• Deep understanding of the Purdue Reference Model (ISA-95) and how IT/OT and cloud convergence reshape the OT attack surface.
• Ability to apply OT specific risk methods (e.g., Bowtie) in a cybersecurity context.
• Expertise in Zones and Conduits (IEC62443) design to ensure network segmentation effectively isolates critical assets.
• Knowledge of OT specific threat actors and tactics (e.g.: MITRE ATT&CK for ICS).
• Understanding OT standards and guidelines, such as IEC62443, ISA-TR-84.00.09 and NIST SP 800-82.
• Understanding the relationship between Functional Safety (IEC 61508/61511) and Cybersecurity (IEC 62443).
• Knowledge of Industrial Control Systems (ICS) and architecture design (preferably ABB, Allen Bradley (Rockwell Automation), Schneider Electric or Siemens).
• Understanding technologies such as NGFW, IDS, IPS, SIEM and others; and how they are deployed in an OT environment to implement a defense-in-dept strategy.
• Familiarity with active and passive monitoring tools (e.g.: Nozomi Networks, Dragos, Claroty, Tenable) to collect data from asset-owners OT networks.
• Ability to interpret OT specific CVEs and their impact on PLCs, RTUs, HMIs and others.
• Ability to perform a site walkdown for physical assessment.
• Ability to select and position monitoring and protection technologies appropriately within an OT architecture.
• Demonstrate expertise in establishing ICS/OT Cybersecurity Governance Framework such as ability to review existing and design new organizational policies and procedures, RACI and others.
• Knowledge of Fortinet products with a NSE4 certification on Secure Networking would be a plus.