Senior OT Risk Assessment Analyst

Lead a comprehensive assessment of operational and cybersecurity risks across operational technology environments. Identify both known and undocumented risks, creating a reliable risk picture to enable informed management decisions and support the engineering of proportionate, fit-for-purpose security solutions. This role requires a deep understanding of industrial operations and how technical weaknesses, failures, or compromises translate into operational and business consequences.

• Plan, structure, and lead end-to-end OT cyber and operational risk identification and assessment across complex industrial environments.
• Apply IEC 62443, particularly IEC 62443-3-2, covering zones and conduits, threat scenarios, risk assessment, and Target Security Levels.
• Assess asset and system criticality, threats, vulnerabilities, likelihood, operational consequences, inherent risk, residual risk, and suitable risk treatments.
• Analyse OT architectures and dependencies, including trust boundaries, critical data flows, IT dependencies, vendors and OEMs, remote access, and external services.
• Evaluate the risk presented by SCADA systems, PLCs, HMIs, engineering workstations, OT networks, remote and vendor connectivity, and legacy or end-of-life technology.
• Lead structured risk-identification workshops with Technical Authorities, Engineering, Operations, Security, and asset or system owners.
• Challenge assumptions and use strong facilitation techniques to identify risks that are not currently documented.
• Assess risk in its operational and business context, considering availability, safety, production, environmental, maintainability, regulatory, and compliance impacts.
• Translate prioritised risks into risk-treatment requirements and high-level solution scopes for subsequent engineering activities.

• Consolidate individual findings into a consistent portfolio-level view of OT risk.
• Identify systemic risks, asset-specific risks, dependencies, risk concentrations, and recurring themes across the portfolio.
• Improve OT risk registers and supporting risk-management processes across organisational boundaries.
• Develop consistent risk statements, ratings, ownership, traceability, and prioritisation.
• Provide clear management-level reporting that supports risk-based decisions by leadership, Technical Authorities, and Engineering teams.

• Strong practical experience in OT or industrial control system security and industrial risk assessment.
• Demonstrated knowledge of IEC 62443 and the ISO/IEC 27001 family of risk-management standards, particularly IEC 62443-3-2 and ISO/IEC 27005.
• Experience applying risk-management principles within industrial or OT environments rather than solely within traditional IT or GRC functions.
• Strong understanding of industrial assets, control systems, operational dependencies, and the consequences of loss of availability or control.
• Ability to facilitate senior technical workshops, challenge assumptions constructively, and communicate risk clearly to technical and non-technical stakeholders.
• Relevant technical or security education, or equivalent senior professional experience.
• Fluent written and spoken English.

• Bachelor's or Master's degree in Cybersecurity, Automation or Control Engineering, Electrical Engineering, Industrial Engineering, Risk Management, or a related discipline.
• IEC 62443 training or certification.
• ISO/IEC 27001 or ISO/IEC 27005 training, certification, or another recognised risk-management qualification.
• Experience with ISO/IEC 27019 controls within the energy or utility sector.
• GICSP, CISSP, CISM, CRISC, or a comparable relevant professional certification.
• Experience within energy, utilities, renewables, or another critical-infrastructure environment.

• The assignment is associated with the Kolding office in Denmark.
• Office attendance for approximately two days per week is preferred.
• Remote working may be considered, although travel to Kolding or other agreed locations for workshops and key meetings is expected.
• The assignment is scheduled from 16th November 2026 to 30th November 2027.


• The engagement is offered on an hourly-rate basis. No additional benefits are specified.