OT Cybersecurity Engineer

The Company

The energy industry is entering one of the most significant periods of growth and transformation in its history. Meeting the nation’s growing demand for reliable electricity will require new ideas, new infrastructure, and talented people committed to building for the future.

At Cypress Creek Energy, we’re meeting that challenge by developing and operating the energy infrastructure needed to power communities, support economic opportunity, and strengthen resilience. We believe our responsibility extends beyond the grid and that how we build matters just as much as what we build.

That same commitment extends to our employees. We invest in professional growth, encourage collaboration across teams, and provide opportunities to take ownership, expand your expertise, and advance your career. Our culture is grounded in safety, accountability, respect, and a shared commitment to deliver results. Join us and help meet one of the most important energy challenges of our time while building a rewarding career.

Overview

Cypress Creek is looking for an OT Cybersecurity Engineer to protect the SCADA and operational technology systems that monitor and control our generation sites. You will maintain OT systems by keeping them patched, protected from malware, monitored for intrusions, ensuring resiliency, and you will work with the SCADA team, IT, and vendors to do it without disrupting operations.

Responsibilities

Patch and vulnerability management

• Track vendor advisories and vulnerabilities for OT assets, including SCADA servers, HMIs, historians, RTUs/PLCs, firewalls, switches, routers, and cellular gateways.
• Test and schedule patches with vendors and site teams. Document approvals, maintenance windows, rollback plans, and exceptions.
• Run vulnerability scans, prioritize findings by risk, and track remediation to closure.
• Report on patch compliance and open vulnerabilities across sites.

Antivirus and endpoint protection

• Deploy and manage antivirus and endpoint protection on OT-appropriate Windows and Linux hosts, including scan schedules and exclusions that will not disrupt control systems.
• Review detections, investigate suspicious activity, and remediate infected or at-risk systems.
• Manage removable media and transient asset controls for vendor and field laptops.

Network intrusion detection and incident response

• Monitor OT network traffic with intrusion detection and monitoring tools such as Dragos, Zeek, Snort, or similar, and tune rules to reduce false positives.
• Triage and investigate alerts in the SIEM, determine scope and impact, and escalate or contain as needed.
• Maintain and test incident response plans, including tabletop exercises with IT, operations, and vendors.
• Review firewall logs, VPN activity, and remote access for anomalies.

Vulnerability Assessments

• Plan and perform active vulnerability assessments of OT assets during approved maintenance windows, using validated scanning methods that minimize operational risk..
• Conduct passive vulnerability assessments using network monitoring, asset discovery, configuration reviews, and available threat intelligence without disrupting control-system operations.
• Analyze and prioritize assessment findings based on exploitability, asset criticality, operational impact, and applicable OT cybersecurity requirements.
• Develop mitigation and remediation plans with asset owners, operations, IT/OT, and vendors; validate corrective actions and track findings through closure or documented risk acceptance.
• Coordinate with third-party assessors on external vulnerability assessments, including defining scope and rules of engagement, facilitating access, reviewing results, and managing follow-up actions.

Resiliency and disaster recovery

• Develop and maintain site-specific OT disaster recovery procedures, including system dependencies, restoration priorities, recovery time and recovery point objectives, and vendor contacts.
• Maintain and monitor secure backups of SCADA servers, HMIs, historians, controller programs, and network device configurations, including offline or immutable copies
• Perform scheduled backup restoration and disaster recovery exercises with operations, IT/OT, and vendors; document results, verify data integrity, and track corrective actions to closure.
• Assess OT systems for single points of failure, maintain redundancy and critical spares, and coordinate failover testing within approved maintenance windows.
• Coordinate safe restoration of OT services following outages or cyber incidents, validating system configurations, communications, and control functionality with operations before returning systems to service.

Compliance and collaboration

• Collect and maintain evidence for NERC CIP requirements covering patching, malware prevention, configuration baselines, vulnerability assessments, and incident response at CIP low and medium impact sites.
• Align controls with NIST 800-82 and NIST CSF, and support internal and third-party security assessments.
• Maintain asset inventories, network diagrams, and security documentation.
• Work with regional teams and third-party vendors on remote access, change control, and security requirements.

Education & Experience Required

• 4+ years in cybersecurity, security operations, or OT/IT systems security.
• Hands-on experience with patch management and vulnerability scanning.
• Experience administering antivirus or endpoint protection tools and responding to detections.
• Working knowledge of network protocols and traffic analysis, including Wireshark and IDS/IPS tools.
• Experience with Windows and Linux system administration.
• Clear written and verbal communication, with the ability to work across technical and non-technical teams.

Preferred Qualifications

• Experience in ICS/SCADA or OT environments such as solar, wind, or utilities.
• Working knowledge of NERC CIP requirements and compliance evidence.
• Familiarity with OT protocols (DNP3, Modbus, IEC 61850) and OT monitoring platforms such as Dragos.
• Experience with the tools listed below, or comparable products.
• Preferred certifications: such as Security+, GICSP, GCIP, CISSP, or CEH.
• Scripting or automation experience (Python, PowerShell, Ansible).

Location: The preferred location for this role is one of our office locations: Durham, NC. Our team operates on a hybrid schedule, with in-office schedule of three days per week.

Benefits:

• 15 days of Paid Time Off, accrual up to 20 days, 11 observed holidays.
• 401(k) Match
• Comprehensive package including medical, dental, vision and health insurance
• Wellness stipend, family planning stipend, and generous parental leave
• Tuition Reimbursement
• Phone Bill Reimbursement
• Company Swag

A note to Recruiting Agencies Cypress Creek Energy Human Resources team does not accept unsolicited resumes from third party recruiters, staffing firms, or related agencies. The Human Resources team coordinates all recruiting and hiring at our company. We do not accept resumes from third-party recruiters unless authorized by the Human Resources team and if a signed agreement is in place. Any unsolicited resumes will be considered property of CCE and we are not responsible for any related fees. All communication related to recruiting partnerships should ONLY be directed to the Human Resources team.

Cypress Creek Energy is an equal opportunity employer and considers all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or veteran status. We are committed to providing a workplace that is inclusive and values diversity, and we encourage candidates from all backgrounds to apply.

Please be aware of recruiting scams—official communications will only come from @ccrenew.com, we will never request personal or financial information, and any suspicious activity should be reported to HR@ccrenew.com.