ARCHITECT - IOT Security

We are seeking an experienced IT/OT Active Directory Segmentation Expert to design, implement, and maintain secure Active Directory architectures that support IT and Operational Technology (OT) environments. The candidate should have strong expertise in Active Directory security, identity segmentation, OT security architecture, and IEC 62443 standards to ensure secure communication between enterprise and industrial networks.
Active Directory Architecture
Design and implement dedicated OT Active Directory environments.
Build secure trust relationships between IT and OT forests where required.
Create Organizational Units (OU), Group Policies (GPO), and security groups.
Implement Tiered Administration (Tier 0, Tier 1, Tier 2).
Harden Domain Controllers using Microsoft security baselines.
IT/OT Network Segmentation
Design secure IT/OT identity segmentation aligned with the Purdue Model.
Support segmentation across:
Enterprise IT
Industrial DMZ (IDMZ)
Manufacturing Zone
Control Zone
Safety Zone
Integrate Active Directory authentication securely within OT environments.
Ensure least-privilege access between IT and OT domains.
IEC 62443 Compliance
Implement security controls based on:
IEC 62443-3-3
IEC 62443-2-1
IEC 62443-4-2
Support implementation of:
Identification & Authentication Control (IAC)
Use Control (UC)
System Integrity (SI)
Restricted Data Flow (RDF)
Resource Availability (RA)
Perform gap assessments and recommend improvements to achieve IEC 62443 compliance.
Group Policy Management
Develop GPOs for:
USB restriction
Password policies
Windows Firewall
Credential Guard
Windows Defender
Remote Desktop restrictions
Audit policies
Application allowlisting (e.g., Microsoft AppLocker or Windows Defender Application Control)
OT Security Integration
Collaborate with OT teams to integrate AD authentication with:
SCADA
HMI
Historians
Engineering Workstations
OPC Servers
Manufacturing Execution Systems (MES)
Support identity integration for industrial platforms such as:
Siemens
Rockwell Automation
Schneider Electric
Honeywell
Emerson
Yokogawa

Work arrangement
No