Ot Security Engineer

Where you fit In:
Shell has been a partner in Oman’s remarkable development and progress over the past several decades. Shell has provided pioneering technologies and expertise to Oman’s energy industry helping to create value for the wider community of which we have proudly been a part.

Position Purpose:
The Operational Technology Security Engineer has the direct responsibility for the Security and the overall management of the Operational Technology in the OT Landscape. The incumbent will work with the Main Automation Contract vendor, Maintenance contractor and the asset to setup and secure the OT landscape, create the procedures, SOP’s and implement all requirements.

The incumbent will represent the operational technology OT security discipline and possess an expert level of understanding of industrial automation and control systems (IACS) and process control networks (PCN) as well as sound understanding of cyber risk management and how it applies to industrial environments and drive the implementation of security programs/projects within Oman Shell.

What's the role?:
Position Responsibilities

The position reports to the Senior MRTA Engineer within the Production Organisation. The position responsibilities span a range of desired outcomes and include:
Role key deliverables

• Have an overview of security measures implemented and documented non-compliance to information security requirements.
• Develop, maintain, and execute any site-specific procedures and SOP’s required to maintain OT security compliance.
• Create/Maintain logical and physical network drawings of OT components.
• Define and rollout Preventative Maintenance plans
• Responsible for all OT security related aspects of the OT comprising of major systems including DCS, IPS/FGS, Electrical and Sub-Systems
• Review OT Security aspects of all data communication channels and technology selections for data transfers between systems in the PCN and systems in other networks.
• Maintain an overview of the security measures that have been implemented for each system. For systems that do not comply with the documented information security requirements, ensure that deviations are in place and effectively managed and remediated.
• Assure that all systems equipment and network components have appropriate backup/restore arrangements and related disaster recovery capabilities.
• Assure stringent access control management for all OT systems and arrange as appropriate with the various stakeholders to ensure competence management of all authorized users.
• Monitor and execute user access control and user profile management for servers and networks based on documented business approval.
• Review security logs and provide reports for identifying potential intrusion into systems and networks, and escalate potential incidents as necessary, and to ensure the incident is properly investigate, remediated, reviewed and closed.
• Manage antivirus solutions to ensure all OT nodes receive effective and up-to-date endpoint protection.
• Perform security updates of operating systems based on recommended frequency.
• Ensure users who leave the company, change their internal positions, or no longer have business needs for access immediately have their access rights revoked
• Evaluate and document the need for back-ups
• Handling and Reporting of OT Security incidents.

Ways of working
- Consistently apply, standard methods, tools, and templates for delivery.

Stakeholder Management

• Maintain interface with Oman Shell IT, Global IT, MAC vendors, ICE discipline, Asset, and engineering departments
• Deliver OT Security training programs for users of the OT systems.

Specific Challenges

• Ensure that OT risk profile and Local Management System (LMS) objectives are achieved and develop fit for purpose solutions to maintain compliance.
• Ensure no production loss, plant trip or quality non-conformance result from tasks performed.
• The role will be rotational field based at Block 10 & 11 concession.

What we need from you:
Industrial and Automation & Control Systems

• Engineering degree or equivalent field/industry experience.
• Experience in a Shell operating asset, IACSs vendor/supplier or equivalent external industry experience.
• Expert level understanding of Shell’s OT environments.

Operational OT Cyber Security

• Proven experience or certification in server/desktop infrastructure design, deployment and maintenance.
• Proven experience or certification on networks including firewalls, routers and switches or hosting/storage infrastructure design and implementation for production systems (CCNA).
• Proven experience or certification in virtual hosting design and deployment (VMWare)
• Proven experience or certification in information risk management such as CISSP, GICSP, CISA, CISM
• Skilled in network and hosting/storage infrastructure design and implementation.
• Experience in Asset Inventory management systems, Intrusion Detection systems, backu