Senior OT Risk Assessment Analyst
Location: Kolding, DenmarkStart Date: 16th November 2026
End Date: 30th November 2027
Work Style: Hybrid or remote (2 office days preferred), 40 hours per week
Role Overview
Lead a comprehensive assessment of operational and cybersecurity risks across operational technology environments. Identify both known and undocumented risks, creating a reliable risk picture to enable informed management decisions and support the engineering of proportionate, fit-for-purpose security solutions. This role requires a deep understanding of industrial operations and how technical weaknesses, failures, or compromises translate into operational and business consequences.
Key Responsibilities
- Plan, structure, and lead end-to-end OT cyber and operational risk identification and assessment across complex industrial environments.
- Apply IEC 62443, particularly IEC 62443-3-2, covering zones and conduits, threat scenarios, risk assessment, and Target Security Levels.
- Assess asset and system criticality, threats, vulnerabilities, likelihood, operational consequences, inherent risk, residual risk, and suitable risk treatments.
- Analyse OT architectures and dependencies, including trust boundaries, critical data flows, IT dependencies, vendors and OEMs, remote access, and external services.
- Evaluate the risk presented by SCADA systems, PLCs, HMIs, engineering workstations, OT networks, remote and vendor connectivity, and legacy or end-of-life technology.
- Lead structured risk-identification workshops with Technical Authorities, Engineering, Operations, Security, and asset or system owners.
- Challenge assumptions and use strong facilitation techniques to identify risks that are not currently documented.
- Assess risk in its operational and business context, considering availability, safety, production, environmental, maintainability, regulatory, and compliance impacts.
- Translate prioritised risks into risk-treatment requirements and high-level solution scopes for subsequent engineering activities.
Risk Governance and Reporting
- Consolidate individual findings into a consistent portfolio-level view of OT risk.
- Identify systemic risks, asset-specific risks, dependencies, risk concentrations, and recurring themes across the portfolio.
- Improve OT risk registers and supporting risk-management processes across organisational boundaries.
- Develop consistent risk statements, ratings, ownership, traceability, and prioritisation.
- Provide clear management-level reporting that supports risk-based decisions by leadership, Technical Authorities, and Engineering teams.
Essential Skills and Experience
- Strong practical experience in OT or industrial control system security and industrial risk assessment.
- Demonstrated knowledge of IEC 62443 and the ISO/IEC 27001 family of risk-management standards, particularly IEC 62443-3-2 and ISO/IEC 27005.
- Experience applying risk-management principles within industrial or OT environments rather than solely within traditional IT or GRC functions.
- Strong understanding of industrial assets, control systems, operational dependencies, and the consequences of loss of availability or control.
- Ability to facilitate senior technical workshops, challenge assumptions constructively, and communicate risk clearly to technical and non-technical stakeholders.
- Relevant technical or security education, or equivalent senior professional experience.
- Fluent written and spoken English.
Desirable Qualifications and Experience
- Bachelor's or Master's degree in Cybersecurity, Automation or Control Engineering, Electrical Engineering, Industrial Engineering, Risk Management, or a related discipline.
- IEC 62443 training or certification.
- ISO/IEC 27001 or ISO/IEC 27005 training, certification, or another recognised risk-management qualification.
- Experience with ISO/IEC 27019 controls within the energy or utility sector.
- GICSP, CISSP, CISM, CRISC, or a comparable relevant professional certification.
- Experience within energy, utilities, renewables, or another critical-infrastructure environment.
Working Conditions
- The assignment is associated with the Kolding office in Denmark.
- Office attendance for approximately two days per week is preferred.
- Remote working may be considered, although travel to Kolding or other agreed locations for workshops and key meetings is expected.
- The assignment is scheduled from 16th November 2026 to 30th November 2027.
- The engagement is offered on an hourly-rate basis. No additional benefits are specified.