Cyber Security Engineer (OT)

Are you passionate about OT-Security and ready to take our monitoring capabilities to the next level

We are seeking a Cyber Security Engineer to lead and mature our OT monitoring environment. You will be responsible for onboarding new production sites fine-tuning detections and ensuring deep visibility into our operational networks. If you enjoy working hands-on with network monitoring incident analysis and continuous improvement of detection logic this role offers a unique opportunity to shape the future of OT-Security at Novonesis.

Welcome to Cyber Defence Centre

Youll join a growing and highly skilled team of cyber-security professionals working across IT and OT domains as advisors engineers and analysts. The team has a strong foothold in the organization and there is a high demand for our competencies in building Novonesis Cyber Defence Centre.

Expect an environment where:

• Your ideas and technical expertise drive tangible improvements to our detection and response capabilities.

• You work with modern platforms such as Nozomi Networks Guardian and Microsoft Sentinel and help define their integration with OT use cases.

• You collaborate closely with site engineers automation specialists and CDC colleagues to translate production-specific risks into actionable monitoring logic.

In this role youll make an impact by:

Operational Focus (60%)

In the day-to-day operations you will:

• Lead the technical onboarding of new OT sites into our monitoring platforms including Nozomi Guardian and Sentinel.

• Perform deep-dive forensics and analysis on alerts and network anomalies to identify root causes and mitigate risks.

• Continuously tune and optimize detection rules thresholds and asset classifications to improve monitoring precision.

• Support improvements in data quality sensor placement and network visibility to ensure robust coverage.

• Assist the CDC in triage and incident investigations ensuring OT-specific events are resolved effectively and lessons are applied for further prevention.

Engineering and Development Focus (40%)

Beyond daily operations you will also:

• Design and implement scalable architectures for OT monitoring and log integration.

• Develop playbooks baselines and enrichment logic to enhance advanced detection and correlation capabilities.

• Collaborate with the OT Security Architecture and GRC teams to align monitoring controls with regulatory requirements like IEC 62443 and NIS2.

• Share knowledge with colleagues through documentation training and collaboration on OT-specific workflows.

To succeed you must hold:

• 46 years of experience in OT or ICS cyber-security preferably from a SOC/CDC or engineering environment.

• A solid understanding of industrial protocols and network architectures across the Purdue model.

• Hands-on experience with Nozomi Networks Claroty or similar OT NIDS platforms.

• Practical knowledge of incident response threat detection and forensic techniques in OT.

• Scripting or automation skills (Python PowerShell REST API) are a plus.

• Familiarity with IEC 62443 NIS2 or related frameworks for secure industrial operations is a plus.

Location: Hørsholm with the option to work in our new office in Carlsberg Byen and global collaboration across sites.

Application deadline: 07 December 2025

Contact details:Petrut Jianu Head of Cyber Defence Centre