OT Risk Manager

Welcome to Ørsted Windpower Operations department. Join us in this role where you’ll be responsible for overseeing and managing the cybersecurity risks associated with Operational Technology (OT) systems within offshore windfarm operation. You will work closely with the Risk Team, key stakeholders, operations, and management to ensure informed decision‑making and compliance with relevant regulations and standards.

You’ll play an important role in:

• Conducting Risk Assessments & Risk Workshops.
• Facilitating risk committee meetings and driving risk reporting towards key stakeholders.
• Establishing cybersecurity frameworks, policies, and procedures tailored for offshore wind farm environments to address risks related to industrial control systems (ICS) and SCADA systems.
• Working closely with OT/IT security and operational technology teams to ensure integration between OT and IT security practices, focusing on the overall protection of critical national infrastructure.
• Ensuring compliance with national and international cybersecurity regulations and standards and managing the reporting of OT security status to regulatory bodies, Cyber Security Boards and others.
• Ensuring that cybersecurity risk management practices comply with regulations, standards and industry best practices for offshore.

To succeed in the role, you:

• Understand IC(S) & SCADA/OT architecture.
• Can implement and take guidance from the IEC 62443, ISO27001 and 27019, The Purdue Reference Model (ISA‑99) and concept models for ICS network segmentation.
• Have experience with operating and managing IC(S) & SCADA components (i.e. PLCs, HMIs, RTUs, and auxiliary systems like HVAC, LV Systems, UPS etc.).
• Understand OT / SCADA & ICS network security and monitoring.
• Have experience with best practice OT Remote access and vendor management.
• Appreciate the difference of the risk management disciplines OT vs. IT: OT: SRP triad (Safety, Reliability, Productivity) IT: CIA triad (Confidentiality, Integrity, Availability).
• Have experience with relevant legislation (UK NCSC CAF, DE BSI/KRITIS, US NERC‑CIP, EU NIS2 and CER) and understanding of how it applies to OT environments and how different authorities audit and inspect across jurisdictions.
• Have a good understanding of risk management principles, especially in the context of operational technology (OT) and critical infrastructure, with the ability to apply ISO 27005’s risk assessment and treatment methods effectively.
• Can translate cybersecurity risks into business‑relevant insights, facilitating risk‑informed decision‑making at higher management levels, balancing technical needs with business priorities.
• Have excellent communication skills for engaging with both technical teams and business leaders. You can convey complex risk scenarios in simple, actionable terms to non‑technical stakeholders.

Employment in this role may be subject to the successful candidate being able to obtain the required security clearance. As an applicant or employee, you may request reasonable work and position accommodation or adjustments via accommodation@orsted.com.