ARCHITECT - IOT Security

We are seeking an experienced IT/OT Active Directory Segmentation Expert to design, implement, and maintain secure Active Directory architectures that support IT and Operational Technology (OT) environments. The candidate should have strong expertise in Active Directory security, identity segmentation, OT security architecture, and IEC 62443 standards to ensure secure communication between enterprise and industrial networks.

Active Directory Architecture

• Design and implement dedicated OT Active Directory environments.
• Build secure trust relationships between IT and OT forests where required.
• Create Organizational Units (OU), Group Policies (GPO), and security groups.
• Implement Tiered Administration (Tier 0, Tier 1, Tier 2).
• Harden Domain Controllers using Microsoft security baselines.

IT/OT Network Segmentation

• Design secure IT/OT identity segmentation aligned with the Purdue Model.
• Support segmentation across:
  • Enterprise IT
  • Industrial DMZ (IDMZ)
  • Manufacturing Zone
  • Control Zone
  • Safety Zone
• Integrate Active Directory authentication securely within OT environments.
• Ensure least-privilege access between IT and OT domains.

IEC 62443 Compliance

Implement security controls based on:

• IEC 62443-3-3
• IEC 62443-2-1
• IEC 62443-4-2

Support implementation of:

• Identification & Authentication Control (IAC)
• Use Control (UC)
• System Integrity (SI)
• Restricted Data Flow (RDF)
• Resource Availability (RA)

Perform gap assessments and recommend improvements to achieve IEC 62443 compliance.

Group Policy Management

Develop GPOs for:

• USB restriction
• Password policies
• Windows Firewall
• Credential Guard
• Windows Defender
• Remote Desktop restrictions
• Audit policies
• Application allowlisting (e.g., Microsoft AppLocker or Windows Defender Application Control)

OT Security Integration

Collaborate with OT teams to integrate AD authentication with:

• SCADA
• HMI
• Historians
• Engineering Workstations
• OPC Servers
• Manufacturing Execution Systems (MES)

Support identity integration for industrial platforms such as:

• Siemens
• Rockwell Automation
• Schneider Electric
• Honeywell
• Emerson
• Yokogawa