Description
Position OverviewThe OT Cybersecurity Compliance & Risk Management Officer is responsible for establishing, assessing, and continuously improving cybersecurity governance, compliance, and risk management across Etihad Rail Infrastructure Operational Technology (OT) environments. The role provides independent oversight and assurance for railway control, signalling, telecommunications, SCADA, industrial control, station, depot, maintenance, and other safety- or mission-critical systems.The position works with Engineering, Infrastructure Maintenance, Operations, IT, Safety, Internal Audit, Procurement, project teams, and third parties to ensure that OT cyber risks are identified, assessed, treated, accepted, monitored, and reported in line with Etihad Rail requirements and applicable standards, particularly ISA/IEC 62443.Roles and ResponsibilityOT Cybersecurity Governance and ComplianceImplement and maintain the OT cybersecurity governance framework, policies, standards, procedures, and control requirements applicable to railway infrastructure systems.Assess compliance against ISA/IEC 62443, ISO/IEC 27001, NIST SP 800-82, UAE Information Assurance requirements, EN 50701 where applicable, and Etihad Rail internal policies.Develop and maintain OT compliance obligations register and map regulatory, contractual, and internal requirements to technical and procedural controls.Plan and execute periodic OT cybersecurity compliance reviews, control self-assessments, assurance activities, and maturity assessments.Maintain an evidence repository for audits, regulatory reviews, management assurance, and project acceptance.Identify control gaps, issue formal findings, agree corrective actions with accountable owners, and track remediation through closureOT Cybersecurity Risk ManagementLead and facilitate OT cybersecurity risk assessments for existing assets, new projects, upgrades, integrations, changes, remote access, and third-party connectivity.Maintain the OT cybersecurity risk register, including asset criticality, threats, vulnerabilities, existing controls, likelihood, impact, inherent risk, residual risk, treatment actions, owners, and target dates.Ensure risk assessments consider potential impact on safety, service availability, operational continuity, environment, financial performance, regulatory obligations, and reputation.Develop and review risk treatment plans using mitigation, avoidance, transfer, and formal acceptance approaches.Escalate high and critical risks, overdue treatments, repeated control failures, and material residual risks to appropriate governance forums.Define and monitor key risk indicators and compliance metrics for management reporting.ISA/IEC 62443 AssuranceApply ISA/IEC 62443 concepts including zones and conduits, security levels, foundational requirements, system risk assessment, secure product development expectations, and cybersecurity management systems.Review system architecture and segmentation against ISA/IEC 62443-3-2 and security requirements against ISA/IEC 62443-3-3.Assess suppliers, integrators, and service providers against relevant ISA/IEC 62443-2-4 requirements and verify that product security capabilities align with ISA/IEC 62443-4-1 and 4-2 expectations where applicable.Ensure target security levels are justified through risk assessment and reflected in technical specifications, designs, test plans, and acceptance criteria.Maintain traceability between identified risks, required controls, design decisions, verification evidence, and residual risk acceptance.Third-Party and Supply-Chain RiskPerform cybersecurity due diligence and risk assessments for OT vendors, original equipment manufacturers, system integrators, maintainers, and managed service providers.Define minimum cybersecurity clauses covering secure development, vulnerability disclosure, patching, remote access, incident notification, audit rights, data handling, subcontractors, and end-of-support obligations.Review supplier security documentation, certifications, architecture, test reports, vulnerability reports, and remediation plans.Monitor third-party compliance and ensure exceptions are documented, risk assessed, time-bound, and formally approved.Audit, Reporting and Continuous ImprovementSupport internal audits, external audits, regulatory inspections, and independent assurance activities relating to OT cybersecurity.Prepare concise management reports on compliance status, key risks, overdue actions, exceptions, audit findings, trends, and maturity improvement priorities.Perform root-cause and thematic analysis of repeated findings, incidents, near misses, and control weaknesses.Contribute to the OT cybersecurity improvement roadmap, annual assurance plan, training needs, and control optimisation initiatives.Promote cybersecurity awareness among engineering, operations, project, procurement, and maintenance stakeholders.Desirable qualifications, skills and experienceAcademic Qualifications: Bachelor's degree in Cybersecurity, Information Security, Computer Science, Computer Engineering.Professional Qualifications:ISA/IEC 62443 Cybersecurity Fundamentals, Risk Assessment, Design, or Expert-level certification is strongly preferred.One or more of the following is desirable: GICSP, CISSP, CISM, CRISC, ISO/IEC 27001 Lead Auditor/Lead Implementer, CISA, or equivalent.Experience: Minimum 6 years of progressive experience in cybersecurity governance, risk, compliance, assurance, or security architecture.At least 3 years of direct experience with OT/ICS, railway, transport, utilities, energy, manufacturing, or other critical infrastructure environments.Demonstrated experience applying ISA/IEC 62443 in risk assessments, architecture reviews, control assessments, supplier assurance, or project delivery.Experience maintaining cyber risk registers, conducting control assessments, managing audit findings, and reporting risk to senior management.Clear, concise communicator in English language, both verbal and written. Good planning skills.