IT Security Consultant

Key Responsibilities

IT Security Audit Execution

·       IT (General controls ) testing with the GRC | Assurance Teams for the IFC compliance Perform

• Plan, scope, and conduct internal IT security audits for 8–12 manufacturing clients annually.
• Assess IT environments (Active Directory, firewalls, patch management, privileged access, MFA, logging/SIEM).
• Evaluate OT/IoT security where IT systems connect to production networks (PLCs, HMIs, SCADA, historians).
• Review compliance with ISO 27001, NIST CSF, IEC 62443-2-1, and GDPR (where applicable).
• Perform audit procedures including:

• Control testing (technical & administrative)
• Vulnerability assessment (non-intrusive)
• Configuration reviews (switches, firewalls, servers)
• Access control & user entitlement reviews
• Backup & disaster recovery validation

• Identify gaps in network segmentation between office IT and shop-floor OT.

Reporting & Remediation

• Document findings with clear risk ratings (Critical, High, Medium, Low).
• Provide manufacturing-specific recommendations (e.g., "air gap backup recovery," "replace unsupported Windows 7 on HMI").
• Present audit reports to plant managers and IT leadership.
• Track remediation progress and perform limited validation re-audits.

Compliance & Standards

• Map audit findings to regulatory requirements (e.g., CMMC, NIS2 if applicable).
• Support clients during external audits or insurance cyber assessments.

Collaboration

• Work with client maintenance and controls engineers (non-security personnel) to explain risks without jargon.
• Escalate critical findings (e.g., ransomware exposure via exposed RDP on a production server) immediately.

Requirements

Experience

• 3–5 years in IT security auditing or security consulting – with at least 1 year directly auditing manufacturing, industrial, or logistics companies.
• Hands-on experience auditing: Active Directory, firewalls (rule base review), Windows/Linux servers, backup solutions, and endpoint AV/EDR.
• Familiarity with industrial protocols (Modbus, PROFINET, OPC UA) – not for deep testing, but to understand risk context.
• Experience using audit frameworks: ISO 27001, NIST 800-53 or CSF, IEC 62443 (awareness level).

Certifications (at least one)

• CISA (preferred)
• ISO 27001 Lead Auditor
• CISSP (or Associate)
• Security+
• Bonus: GICSP or ISA/IEC 62443 Cybersecurity Fundamentals

 

 

Technical skills

• Auditing vulnerability scan results (Tenable, Qualys, or Rapid7)
• Basic scripting for evidence collection (PowerShell, Python, or bash)
• Familiarity with compliance tools (e.g., Vanta, Drata, or manual checklists)

Soft skills

• Ability to interview plant operators and IT admins without creating friction.
• Clear report writing – no excessive jargon.
• Pragmatic risk mindset: "Secure enough for production uptime."

Preferred (Nice to Have)

• Past role in managed security services or internal audit for a manufacturer.
• Understanding of ransomware impact on production schedules (e.g., downtime cost modeling).
• Experience with NIST 800-82 or C2M2.

Work Environment & Travel

• Up to 30–40% travel to manufacturing sites (safety training required – steel-toe boots, hearing protection, etc.).
• Audits are typically 1–2 weeks on-site per client, then remote for reporting.

Benefits

• Competitive base salary + audit completion bonuses.
• Opportunity to shape security posture in critical infrastructure.