Senior Specialist, OT Cyber Security

• Permanent Full Time
• From $166k package
• Footscray location | Hybrid

About Greater Western Water

We’re water… and more.

GWW is a Victorian government owned water corporation that provides an essential service to some of the fastest-growing communities in Australia, stretching from Melbourne’s CBD to Lancefield in the north and Bacchus Marsh in the west. Click here to learn more

Benefits

• We embrace flexibility and connection with a balance of on-site and WFH
• Free onsite parking (subject to availability)
• Gender neutral, 16-week parental leave available from commencement
• Eligible full-time employees may access additional Work Life Balance Days, subject to eligibility criteria, helping you prioritise wellbeing and flexibility.
• Free income protection and salary continuance insurance
• Access to corporate health insurance deals with major providers
• Wellbeing, prayer, and sensory rooms in the Footscray and Sunbury office

The opportunity

We are looking for an experienced and practical OT cyber security professional to help shape and deliver the next stage of GWW’s OT security uplift. This is a hands-on role for someone who understands that protecting SCADA and industrial control systems requires a different approach from conventional enterprise IT, with safety, reliability and service continuity at the centre of every decision.

Reporting to the Head of Cyber Security and working closely with the OT Manager, you will assess the current environment, establish a fit-for-purpose OT cyber security framework and roadmap, and translate it into practical improvements across people, process, architecture and technology. You will work across legacy and modern environments, helping GWW strengthen visibility, segmentation, secure remote access, vulnerability management, monitoring, incident response, recovery and supplier assurance.

This is an opportunity to influence how OT cyber security is established across an essential-services organisation. You will be trusted to provide specialist advice, but equally expected to roll up your sleeves and deliver outcomes with OT, Engineering, Operations, IT, Network, Capital Delivery, Facilities, Risk and external service partners.

Responsibilities

• Lead the assessment of GWW’s OT cybersecurity posture and develop a prioritised, achievable roadmap and control framework to guide the implementation, enhancement and ongoing management of security controls across OT environments.
• Design, implement, review and maintain secure OT architectures and controls across SCADA, ICS, PLC, RTU, telemetry and industrial network environments, including IT/OT boundaries, network segmentation, secure remote access and privileged access.
• Identify, assess and manage cybersecurity risks across OT assets, networks and industrial systems through risk assessments, control reviews and targeted remediation strategies that balance security with operational reliability, safety and business continuity.
• Establish and drive practical OT vulnerability management, patching, hardening and legacy-system risk processes, considering asset criticality, operational constraints, vendor support, maintenance requirements and appropriate compensating controls.
• Provide cybersecurity leadership and oversight for OT projects, technology upgrades and system changes, embedding security-by-design into procurement, supplier requirements, system integration, design reviews, testing, commissioning, operational handover and ongoing change management.
• Develop and strengthen OT security monitoring, threat detection and asset visibility capabilities, while monitoring emerging threats and vulnerabilities that may affect GWW’s operational environments.
• Support the investigation, containment and response to OT cybersecurity incidents, and develop practical isolation, recovery and restoration capabilities that minimise operational disruption and enable essential services to be safely restored.
• Plan and support exercises, testing and assurance activities to confirm that OT cybersecurity controls, incident-response procedures, isolation arrangements, backups and recovery processes are effective in practice.
• Support compliance with applicable critical infrastructure, regulatory and industry cybersecurity obligations through audits, assurance activities, risk documentation, evidence management and continuous improvement initiatives.
• Partner with OT, Engineering, Operations, Project Delivery, Technology, Network, Cyber Security, Risk and external service providers to deliver secure operational outcomes, provide specialist advice and support the ongoing development and delivery of GWW’s OT cybersecurity roadmap.

Skills & Experience

• Demonstrated hands-on experience securing OT, ICS or SCADA environments, with practical knowledge of industrial networking and OT network security.
• Demonstrated ability to assess a developing OT cybersecurity environment and translate risk, regulatory and strategic requirements into a practical roadmap, standards, secure architectures, implemented controls and measurable improvements.
• Strong practical knowledge of OT security architecture and controls, including zones and conduits, firewalls and industrial DMZs, IT/OT segmentation, secure remote access, identity and privileged access management, asset visibility, vulnerability management, security monitoring, backup and cyber recovery.
• Practical experience applying OT cybersecurity frameworks, standards and guidance, particularly AS IEC 62443 and NIST SP 800-82, with working knowledge of NIST CSF, ISO 27001, relevant Australian Government OT guidance, and SOCI Act and CIRMP obligations.
• Ability to develop OT cybersecurity requirements, standards and engineering documentation, and to verify the effectiveness of controls through design reviews, configuration assessments, security testing, and operational handover.
• Experience identifying, assessing and mitigating vulnerabilities and emerging threats affecting OT environments, including legacy systems, unsupported assets and systems with operational or vendor-imposed patching constraints.

• Strong analytical, problem-solving and decision-making skills, with the ability to investigate complex cybersecurity issues, assess operational consequences and respond effectively under pressure.
• Excellent communication and stakeholder-management skills, with the judgement to work productively with operators, control-system engineers, OT, Engineering, Facilities, IT and Network teams, Cyber Security specialists, project teams, vendors, service providers and senior leaders.
• A commitment to continuous learning and professional development, with an interest in emerging OT threats, industrial security technologies, SCADA environments, secure engineering practices and security-by-design delivery.

Skills & Qualifications:

• A tertiary qualification in cyber security, electrical/electronic engineering, automation, control systems, computer science, information technology, telecommunications, networking or a related discipline, or equivalent substantial industry experience. (desirable)
• Relevant certifications such as ISA/IEC 62443, GIAC GICSP/GRID/GCIP, CISSP, or equivalent credentials. These are desirable rather than mandatory where strong practical OT experience can be demonstrated. (desirable)
• Experience in water and wastewater, energy, transport, mining, manufacturing or another critical-infrastructure sector is strongly preferred.
• Experience with common OT technologies and protocols such as industrial Ethernet, Modbus, DNP3, OPC, MQTT or vendor-specific SCADA/PLC platforms.
• Experience with OT visibility and monitoring platforms such as Claroty, Nozomi Networks or equivalent, and integration with SIEM/SOC capabilities.

See yourself thrive

Our vision for GWW is Thriving People and Country. We aim to be as diverse as the communities we serve and are deeply committed to building a workplace where everybody thrives. We’re supportive, inclusive, and friendly, and value everyone for who they are and what they can bring.  

We’re seeking applicants across all cultural backgrounds, genders, and abilities, and will make reasonable adjustments as required, so please talk to us about what you need.

Don’t meet every single requirement? If you’re excited about this role, we encourage you to apply.

Don’t delay your application, include your resume, and cover letter (no more than 1 page), shortlisting will commence early!

The successful candidate will be required to complete pre-employment checks, including reference checks, medical assessments, a national police check, and verification of working rights in Australia.

Please note: this role has been classified as a Critical Worker under the Security of Critical Infrastructure (SOCI) Act and GWW’s Critical Infrastructure Risk Management Program. As such, the successful candidate will also be required to undergo additional security clearance checks in line with legislative obligations.

Applications close: Sunday 22 November