Principal OT Product Security Architect

About the role

Dematic is looking for a Principal OT Product Security Architect to act as a technical leader of OT product security architecture. Reporting to the Chief Product Security Architect, the role gives strategic security guidance to product development, execution, sales and support teams, defines and implements a security strategy for all Dematic OT products, and works with technology leadership and engineering teams to build secure products that meet regulatory requirements.

Key responsibilities

• Define and maintain OT cybersecurity architecture, requirements, standards and reference architectures, and lead security architecture and design reviews.
• Define secure network architectures including segmentation, zones/conduits, firewalls, industrial DMZs, secure remote access and OT-to-cloud connectivity.
• Integrate secure-by-design and DevSecOps principles into product lifecycles and define cybersecurity requirements for products, software and embedded components.
• Lead or support threat modeling, vulnerability assessments, penetration testing and security architecture assessments, and establish risk-based remediation approaches.
• Translate standards such as IEC 62443, NIST CSF, NIST SP 800-82, ISO 27001 and the EU Cyber Resilience Act into technical requirements, and support product certification, audits and customer security reviews.
• Perform OT cybersecurity assessments, partner with engineering and operations teams, and mentor teams on secure design practices.

Required profile

• Bachelor's or Master's degree in Cybersecurity, Computer Science, Computer or Electrical Engineering, Information Technology or a related field, or equivalent experience.
• 8+ years of cybersecurity, OT/ICS security, product security, network security or systems engineering experience, including designing or assessing OT cybersecurity architectures.
• Experience with industrial automation, robotics, warehouse automation, manufacturing and control systems.
• Ability to influence technical decisions without direct authority, strong communication and stakeholder management, and occasional travel to customer sites.
• Must be authorized to work in the U.S. without sponsorship; hybrid role near a U.S. office (Grand Rapids MI, Atlanta GA or Plano TX).

Required skills

• OT/ICS architecture, industrial networks, PLCs, HMIs, SCADA, segmentation, firewalls, VPNs and secure remote access.
• Vulnerability management, penetration testing, threat modeling, security monitoring and risk-based remediation.
• Working knowledge of networking, Windows/Linux, cloud environments and scripting such as Python or PowerShell.
• Preferred certifications: CISSP, GICSP, GRID, GCIP, Security+, Network+, ISA/IEC 62443 (IC32/IC33).

What we offer

• Base pay range of $147,600 - $184,500, depending on location, education, experience and skills.
• Career development, competitive compensation and benefits, pay transparency and global opportunities.