Cyber SDC -Solution Architect - OT Monitoring & Security Tooling

Role Description

PRACTICE DESCRIPTION

Operational technology environments require sustained visibility, monitoring, security tooling, and operational integration to support stable, secure, and compliant operations. The Solution Architect – OT Monitoring & Security Tooling role provides technical leadership for the strategy, architecture, integration, and continuous improvement of monitoring, asset visibility, detection, and security enablement platforms used in industrial and operational technology environments.

This role works across operations, cybersecurity, platform engineering, asset management, network/security operations, SOC teams, vendors, and site stakeholders to improve monitoring coverage, platform health, event visibility, alert quality, and supportability across OT environments.

JOB SUMMARY

We are seeking a senior Solution Architect – OT Monitoring & Security Tooling to provide solution architecture leadership for OT monitoring, visibility, detection, and security tooling capabilities supporting industrial and operational technology environments.

The role is responsible for defining monitoring and tooling strategies, validating platform capabilities, identifying visibility gaps, guiding tool integrations, supporting incident and alert workflows, and aligning OT security tooling with operational support needs. The architect helps ensure monitoring platforms, asset visibility tools, security telemetry, alerting workflows, and operational integrations remain effective as the OT environment scales and matures.

This is a senior operations-oriented architecture role focused on platform strategy, monitoring maturity, integration alignment, technical advisory support, and continuous improvement. The role provides technical direction and solution guidance while partnering with operations teams responsible for day-to-day service execution.

KEY RESPONSIBILITIES

OT Monitoring and Visibility Strategy

• Define and maintain OT monitoring, visibility, and security tooling strategies aligned to operational support needs.
• Establish monitoring coverage expectations for OT environments, including asset visibility, network traffic monitoring, platform health, and event visibility.
• Identify gaps in monitoring coverage, telemetry quality, alert fidelity, and visibility across site environments.
• Develop recommendations to improve monitoring effectiveness, operational supportability, and security outcomes.
• Partner with operations and cybersecurity teams to maintain a practical roadmap for monitoring and tooling maturity.

Security Tooling Architecture and Platform Alignment

• Provide solution architecture leadership for OT monitoring, asset visibility, vulnerability, endpoint, remote access, and security enablement platforms.
• Evaluate how OT monitoring platforms integrate with enterprise security services, SOC workflows, CMDB/asset platforms, and operational support tools.
• Support architecture decisions for tooling integrations, data flows, alert routing, platform onboarding, and support model alignment.
• Coordinate with platform owners and operational teams to improve platform health, coverage, usability, and lifecycle management.
• Support standardization of monitoring and security tooling patterns across OT environments.

Detection, Alerting, and SOC Integration

• Define monitoring and alerting requirements for OT security and operational support use cases.
• Support development, tuning, and improvement of OT detection logic, alert workflows, escalation paths, and event triage processes.
• Partner with SOC, incident response, and operations teams to improve the usability and actionability of OT alerts.
• Review alert volumes, false-positive trends, visibility gaps, and escalation performance to drive continuous improvement.
• Support integration of OT monitoring outputs with enterprise detection and response processes.

Asset Visibility and Data Integration

• Support solution architecture for OT asset discovery, asset inventory enrichment, and visibility integration with operational systems of record.
• Guide integration patterns between OT monitoring platforms, asset discovery tools, CMDB, service management platforms, vulnerability workflows, and reporting capabilities.
• Identify opportunities to improve asset context, communication baselines, vulnerability visibility, and operational data quality.
• Support definition of minimum required OT asset attributes and data quality expectations for operational support.
• Partner with asset management and operations teams to improve asset visibility maturity over time.

Platform Health, Lifecycle, and Reliability

• Monitor and evaluate health, coverage, reliability, and lifecycle status of OT monitoring and security tooling platforms.
• Support planning for platform upgrades, patching, configuration validation, sensor/collector health, data ingestion, and tool lifecycle activities.
• Identify operational risks related to platform degradation, incomplete coverage, unsupported integrations, or tooling drift.
• Provide architecture guidance for remediation of recurring tooling or monitoring issues.
• Support continuous improvement of platform reliability, supportability, and operational maturity.

Operational Escalation and Technical Advisory

• Serve as a senior technical advisor for complex OT monitoring, tooling, telemetry, visibility, and security platform questions.
• Support escalations involving monitoring gaps, alerting issues, integration defects, platform health problems, or operational visibility challenges.
• Coordinate with engineering, cybersecurity, SOC, network/security operations, site teams, and vendors to resolve complex tooling concerns.
• Translate operational pain points into architecture, integration, or process improvement recommendations.
• Provide guidance to operations teams while preserving clear day-to-day operational ownership.

Standards, Patterns, and Continuous Improvement

• Develop and maintain practical monitoring and tooling guidance for OT operations teams.
• Define repeatable patterns for monitoring coverage, alert routing, platform onboarding, asset visibility, and operational integration.
• Support lessons learned reviews and identify systemic improvements to tooling, processes, or support models.
• Produce architecture guidance, operational playbooks, platform integration notes, and decision records as needed.
• Drive continuous improvement of OT monitoring and security tooling capabilities as the operational footprint grows.

RELEVANT TECHNOLOGY AREAS

The role may work with or provide architectural guidance for technologies and platform categories such as:

• OT monitoring and asset visibility platforms such as Nozomi Networks, Claroty, Dragos, or comparable OT visibility solutions.
• Asset discovery and enrichment platforms such as runZero or comparable discovery tooling.
• Service management, CMDB, and workflow platforms such as ServiceNow and related service graph or integration capabilities.
• Enterprise vulnerability management and security platforms such as Qualys or comparable vulnerability management tooling.
• Security monitoring, SIEM, SOC, and incident response platforms used for detection, alerting, triage, investigation, and escalation.
• Endpoint, remote access, network security, Zero Trust, and firewall platforms that provide telemetry or support OT operations workflows.
• Dashboards, reporting, and operational analytics tools used to monitor coverage, health, risk, and support performance.

QUALIFICATIONS

• Bachelor's degree in Information Technology, Cybersecurity, Engineering, Computer Science, or equivalent experience preferred.
• 8+ years of experience in cybersecurity, infrastructure, monitoring, security operations, operational technology, platform architecture, or solution architecture roles.
• Experience supporting monitoring, visibility, security tooling, SOC integration, asset management, or operational support platforms.
• Strong understanding of operational technology environments, industrial networks, asset discovery, security monitoring, and managed operations.
• Ability to translate operational monitoring and tooling needs into practical architecture, integration, and improvement plans.
• Experience collaborating across operations, SOC, cybersecurity, engineering, platform, vendor, and site teams.
• Strong analytical, communication, documentation, and technical leadership skills.

Preferred Qualifications

• Experience with OT monitoring or visibility tools such as Nozomi Networks, Claroty, Dragos, runZero, or comparable platforms.
• Experience with ServiceNow CMDB, Service Graph, OT asset inventory, vulnerability response, or operational workflow integrations.
• Familiarity with SIEM/SOC operations, detection engineering, alert tuning, incident response, and escalation workflows.
• Knowledge of network traffic analysis, industrial protocols, Purdue Model concepts, and OT security monitoring approaches.
• Experience with vulnerability management, endpoint security, remote access, Zero Trust, firewall, or network security tooling in operational environments.
• Relevant certifications such as CISSP, GICSP, GIAC certifications, Security+, Network+, CCSP, ITIL, or comparable security/operations certifications.

TECHNICAL SKILLS

WHAT WE OFFER

At EY, we are committed to professional development and career growth. This role provides the opportunity to work across cybersecurity, OT operations, platform engineering, security monitoring, asset management, and managed services teams. The role offers exposure to complex industrial environments and the opportunity to improve monitoring visibility, security tooling effectiveness, and operational resilience across OT environments.

SHORT STAFFING PROFILE VERSION

Solution Architect – OT Monitoring & Security Tooling: Provides operations-oriented solution architecture leadership for OT monitoring, asset visibility, detection, security tooling, platform health, SOC integration, and operational visibility. Guides tool strategy, monitoring coverage, telemetry quality, alerting workflows, platform integrations, and continuous improvement across OT environments. Works with operations, SOC, cybersecurity, platform, asset management, and site teams to improve monitoring effectiveness and supportability while partnering with teams responsible for day-to-day service execution.