DESKTOP / END USER ENGINEER

This is a hands-on engineering role at the heart of how our ICS community works; designing, building, and supporting the end-user platforms that keep both modernised and legacy sites running smoothly.

Accountability

• Own the technical lifecycle of the gold laptop image and of the Workstation image set: design, package, lock-down, test, release, refresh.
• Work side by side with engineering teams to develop and test builds against real engineering workflows.
• Work with domain specialists to package or tune applications and security configurations so tools remain usable and remain inside the agreed envelope.
• Run iterative test cycles with security so that cyber risk vectors associated with data transfer across the platform boundary, including between virtualised environments and operational networks, are identified, treated and formally assured.
• Support controlled rollout of new laptops to the ICS engineering community and the subsequent sustainment of images and overlays.
• Define a simple operating model for how engineers obtain updated Workstation images across a range of connectivity scenarios, from centrally managed refresh to site-level distribution, without weakening the isolation model.
• Document the intended use of host versus image and the constraints engineers must work within, at a level that operations and Security can both live with.

Capabilities and skills

This is a practitioner role, not a purely process or ticket-handling role. The successful candidate will be comfortable moving between image engineering, application packaging, controlled virtualisation and a security conversation that is specific to ICS environments.

• Desktop and end-user image engineering: gold images, driver baselines, layered or overlay software for distinct teams.
• Local hypervisor image design, hardening and lifecycle management.
• Practical understanding of ICS and OT engineering tooling and why legacy plant environments cannot simply be replaced on a timetable.
• Ability to design controls around high-risk transfer paths without making the platform unusable.
• Working knowledge of enterprise host controls and an understanding of their scope and limitations when applied to isolated or non-standard guest environments.
• Comfort working with Security as a design partner through repeated test-and-adjust cycles, rather than a single gate at the end.
• Clear communication with engineers who need tools to work and with assurance teams who need evidence that risk is bounded.