Senior Analyst, OT Security

About Fervo Energy
Fervo Energy (NASDAQ: FRVO) is a modern power company developing next-generation geothermal resources to meet the growing demand for affordable, reliable, 24/7 carbon-free energy. Our mission is to transform geothermal into America’s most dependable and affordable source of clean, around-the-clock power. By combining innovations in horizontal drilling, fiber-optic sensing, and advanced reservoir engineering, Fervo has developed a repeatable approach to building utility-scale enhanced geothermal systems. Our flagship Cape Station development in Utah is planned to deliver 500 MW of firm, carbon-free power, and we are advancing a development pipeline of more than 50 GW. Join us and work alongside world-class engineers, geoscientists, operators, project builders, and business leaders working to make geothermal a cornerstone of a more reliable, affordable, and sustainable energy future.
Position Description
The Senior OT Security Analyst is a hands-on cybersecurity professional responsible for strengthening the security and resilience of Fervo’s operational technology environments. The role partners with Operations, OT and controls engineering, project delivery, IT, enterprise cybersecurity, compliance, legal, and third parties to translate OT security program objectives into durable technical controls, operating processes, and defensible evidence.
This analyst evaluates OT architectures and data flows, supports secure commissioning and change management, improves asset and configuration visibility, governs remote and vendor access, develops monitoring and incident-response capabilities, and maintains risk and remediation records. The role applies NIST SP 800-82 Rev. 3 and IEC 62443 concepts and supports NERC CIP governance where applicable, without independently determining regulatory applicability or certifying compliance.
Responsibilities
OT Program Governance and Risk
Translate program objectives into execution. Develop and maintain practical OT security standards, procedures, control requirements, checklists, and review cadences that can be used by site, engineering, project, and vendor teams.
Maintain the OT risk lifecycle. Document risk scenarios, operational consequences, existing safeguards, treatment plans, owners, due dates, exceptions, accepted risks, and closure evidence.
Support governance and assurance. Prepare status metrics, decision records, issue escalations, control evidence, and review materials for OT cybersecurity and compliance forums.
Support NERC CIP readiness where applicable. Partner with Compliance and accountable business owners on asset scoping, control ownership, recurring evidence, exception management, and audit preparation; avoid unsupported compliance conclusions.
Asset, Vulnerability, and Configuration Management
Improve OT asset awareness. Maintain or validate inventories for controllers, RTACs, HMIs, historians, engineering workstations, network devices, security appliances, communications gateways, and supporting services.
Assess vulnerabilities in context. Evaluate exposure, exploitability, operational consequence, compensating controls, vendor guidance, and outage requirements rather than relying on CVSS scores alone.
Strengthen configuration control. Define secure baselines, configuration backup expectations, account and service reviews, network rule reviews, time synchronization, and change records for critical OT components.
Coordinate remediation. Work with asset owners and vendors to plan testing, approvals, maintenance windows, rollback, validation, and closure evidence for patches and other risk treatments.
Monitoring, Incident Response, and Recovery
Develop safe OT monitoring coverage. Identify priority log sources and passive network visibility points; support secure collection, normalization, alerting, retention, and documented blind-spot management.
Investigate OT security events. Triage anomalies and alerts, correlate technical evidence with operating conditions, preserve records, coordinate escalation, and distinguish cyber activity from equipment or process faults.
Advance response readiness. Maintain OT-specific playbooks, contacts, decision paths, communications procedures, evidence handling, and interfaces with enterprise incident response and site emergency processes.
Validate recovery capability. Support backup and restoration testing, controller and network configuration recovery, clean rebuild planning, manual or degraded operating procedures, and lessons-learned tracking.
Identity, Remote Access, and Third-Party Security
Govern privileged and remote access. Promote individual identities, MFA, brokered access, least privilege, time-bound approval, controlled file transfer, session logging, emergency access, and prompt revocation.
Review vendor access and support models. Validate business need, technical reach, approval authority, support windows, monitoring, account ownership, contractual responsibilities, and offboarding.
Reduce shared-service risk. Assess OT dependencies on identity, DNS, time, virtualization, cloud, cellular, and IT-managed services and document resilient or degraded-mode options.