Senior Cybersecurity Engineer (Center of Excellence)

Job Description Summary
We are looking for a senior OT cybersecurity engineer to join the Grid Automation Cybersecurity Centre of Excellence (COE), a new central team that owns how cybersecurity is executed on GA projects worldwide.

The role is hands-on. You will design, build, configure, test and optionally commission security solutions on complex utility and industrial projects. You will then turn that work into the standards, templates and training that regional teams use on every project that follows.

You will be the recognized technical owner for a set of solutions in the GA cybersecurity portfolio, covering areas such as firewalls, OT network monitoring, secure remote access, identity, PKI, SIEM, etc... Regional teams will come to you when a project goes beyond their depth.

You will also make execution faster and more consistent. That means automating repeatable build and verification work in PowerShell, and using frontier AI models to shorten documentation, requirements mapping and configuration review, while engineering judgement and the protection of customer data stay firmly with you.

Job Description
About the Cybersecurity COE
The COE gives GA a single owner for cybersecurity execution standards and process across all regions. It reports into the GA OT Cybersecurity Product Line and covers five functions:

- Delivery of complex project scope, and specialist support to regions on demand.

- A standard execution toolkit: security plans, reference architectures, checklists, templates and automation scripts that regions can apply directly.

- A structured competency programme of periodic technical and non-technical training.

- Formal cybersecurity reviews at key project milestones.

- Regulatory intelligence on IEC 62443, NERC CIP, NIS2, CRA and regional mandates, so execution teams are ready for compliance before customers ask.

Roles and Responsibilities
Project execution

- Lead the cybersecurity workstream on Tier 1 projects end to end: requirements review, security architecture, detailed design, build, configuration, FAT, SAT, commissioning and handover.

- Work hands-on in staging and at customer sites: build and harden Windows and Linux servers, and configure firewalls, Active Directory, PKI, KDC, network intrusion detection, SIEM and syslog, application control, backup and recovery, and secure remote access.

- Produce the project security deliverables: security plan, zone and conduit model, risk assessment, hardening records, test procedures and reports, and the security handover package.

- Map customer requirements to contract scope early, flag deviations as they arise, and give project managers the technical basis for change orders.

- Support tender and project teams with scope definition and effort estimates for complex cybersecurity scope.

Execution standards and toolkit

- Act as the technical owner (Expert) for an assigned set of COE competencies. Set the reference configuration for each and keep it current with product and partner releases.

- Build the GA execution toolkit as a by-product of delivery: reference architectures, configuration baselines, build checklists, PowerShell scripts, how-to guides, test procedures and templates.

- Run formal design and configuration reviews at project milestones, so misconfigurations are found before FAT and handover rather than by the customer.

- Capture lessons learned at project close and feed them back into the toolkit.

Automation and AI-assisted execution

- Write and maintain PowerShell scripts and modules that automate repeatable execution tasks: Windows Server and workstation hardening, Active Directory and Group Policy build, account and group provisioning, certificate enrolment, audit policy and log forwarding setup, and backup job configuration.

- Build automated checks that compare as-built systems against the COE reference baselines and produce the evidence for milestone reviews, FAT and SAT, so verification no longer depends on manual screenshots and spot checks.

- Use frontier AI models to speed up execution work: drafting and reviewing security plans, test procedures and as-built documents; mapping customer specifications against IEC 62443-3-3 requirements; analysing firewall rule bases, configuration exports and logs; and writing and reviewing scripts.

- Use AI only within GE Vernova approved platforms and data-handling rules. Customer configurations, network drawings and logs from critical infrastructure stay inside approved boundaries, and an engineer verifies every AI output before it reaches a customer or a live system.

- Turn proven scripts, prompts and AI-assisted workflows into toolkit assets, so regional engineers get the same gains on Tier 2 and Tier 3 projects.

Competency building

- Design and deliver structured technical training for regional engineers, from foundation to advanced level, on the solutions you own.

- Coach regional engineers on live projects, so that project types can move from Tier 1 to Tier 2, and from Tier 2 to Tier 3.

- Maintain independent working capability (Backup) in competencies owned by COE colleagues, so the team keeps delivering when one person is unavailable.

Specialist support and regulatory intelligence

- Provide on-demand support to regional teams on design questions, site troubleshooting and escalations.

- Support patch management, vulnerability assessment and incident response engagements on GA-delivered systems, working with Product Security.

- Track IEC 62443, NERC CIP, NIS2, CRA, IEC 62351 and regional mandates, and translate new requirements into execution checklists and deliverables.

- Help regional teams answer customer compliance questions that arise during project execution.

Product and partner feedback

- Feed field experience back to Product Management and R&D: integration issues, recurring defects and gaps in the portfolio.

- Support validation and first deployments of new GA cybersecurity solutions as they come through NPI.

- Work with technology partners on integration, technical escalations and joint validation.

Required Qualifications

- Bachelor's or master's degree in Electrical, Electronics or Computer Engineering, Computer Science, or equivalent work experience.

- 8+ years in industrial automation or the energy sector, including at least 5 years delivering OT cybersecurity hands-on on customer projects, from design through commissioning.

- Applied knowledge of IEC 62443 on real projects, in particular 3-2 (risk assessment, zones and conduits), 3-3 (system security requirements and security levels) and 2-4 (service provider requirements).

- Working knowledge of NERC CIP, NIS2, CRA, IEC 62351 and NIST guidance, and how each translates into project deliverables.

- Expert-level, hands-on depth in at least three of the following areas, and working capability in most of the rest:
- Next-generation firewalls (Fortinet preferred)

- OT network intrusion detection and monitoring (Nozomi, Dragos or similar)

- Secure remote access for industrial systems (Xona or similar)

- Active Directory, Group Policy, RADIUS and LDAP

- Public key infrastructure and certificate lifecycle management

- SIEM and syslog collection (Splunk or similar)

- Centralised security management platforms

- Application control and host intrusion prevention (Trellix or similar)

- Backup and disaster recovery

- Windows and Linux server build, hardening and virtualisation

- Hardening of IEDs, RTUs, gateways and other field devices

- Sound understanding of substation and grid automation (protection and control, RTUs, gateways, SCADA and EMS) and the protocols that run them: IEC 61850, DNP3, IEC 60870-5-104 and Modbus.

- Working proficiency in PowerShell for Windows Server and Active Directory administration: the ActiveDirectory and GroupPolicy modules, remoting, error handling and logging, and running signed scripts under the restricted execution policies typical of OT environments.

- Practical, regular use of frontier AI models (such as Claude, ChatGPT, Gemini or Microsoft Copilot) in engineering work, with the judgement to check outputs, catch errors and keep sensitive customer data out of unapproved tools.

- A track record of producing project security documentation that customers and auditors accept.

- Experience training and mentoring engineers.

- Willingness to travel 20–40%, including extended site stays, and to join calls across time zones.

Desired Characteristics

- Certifications such as GICSP, GRID, ISA/IEC 62443 Cybersecurity Expert (or its specialist certificates), CISSP, Fortinet FCP or FCSS (formerly NSE 4 and NSE 7), Splunk Core Certified, or vendor training on Nozomi or Dragos.

- Experience as the cybersecurity lead on large utility, data centre or industrial projects with multiple vendors and a demanding customer.

- Experience building AI-assisted engineering workflows, such as structured prompt libraries, agent-based tools or API integrations, for document generation, requirements mapping or log triage.

- Configuration-as-code and scripting discipline: PowerShell DSC or Ansible, Pester tests for scripts, Git version control, and Bash or Python for Linux systems.

- Writes clear, precise documentation. A checklist or procedure written by this person can be followed by an engineer who has never met them.

- Teaches well. Can explain a design decision to a junior engineer and defend it to a customer's security team.

- Holds scope boundaries with customers firmly and professionally, and understands that scope discipline protects both schedule and margin.

- Works comfortably in a global organisation with people from many cultures and backgrounds. Additional languages are an advantage.

- Takes ownership. Treats a problem found on one project as a gap in the toolkit, and fixes the toolkit.

Additional Information
Relocation Assistance Provided: Yes

Candidates should be aware that this role involves a client's critical infrastructure; shortlisted candidates would therefore be subject to heightened security checks as directed by our clients. All personal data will be handled with the utmost confidentiality and in accordance with our data protection policies, solely for recruitment and security purposes.