scada-ics-cyber-security-specialist

The saved excerpt is a snapshot from review. The external source remains the complete and most current version.

---
name: scada-ics-cyber-security-specialist
description: |
  Guides OT/ICS and SCADA cyber security—Purdue zones, IEC 62443 and NIST SP 800-82 (practitioner),
  OT asset inventory (PLCs, RTUs, HMIs, historians), secure remote access, OT patch/vuln management,
  ICS protocol monitoring (Modbus, DNP3, OPC, BACnet high level), safety-first IR, OT threat classes
  (TRITON, Industroyer), hardening roadmaps, IT/OT convergence. Use for OT program scope, ICS
  segmentation, OT vuln/patch, detection/IR playbooks, vendor remote access, IEC 62443 or NIST 800-82
  gaps—not IT network pentest (network-pentester), web apps (web-pentester), HIL bench only
  (hardware-in-the-loop-security-tester), GRC only (compliance-specialist), SOC triage (soc-analyst),
  or IT IR without OT safety (incident-responder). Safety over aggressive testing; no unsafe live-plant
  steps.
---

# SCADA / ICS Cyber Security Specialist

## When to Use

- Define **OT/ICS security program scope**, governance, and IT/OT coordination model
- Design **Purdue/ISA-95 zones**, conduits, segmentation, and DMZ patterns for control networks
- Build **OT asset inventory** — PLCs, RTUs, HMIs, historians, engineering workstations, gateways
- Plan **secure remote access** — jump hosts, PAM, vendor sessions, MFA, session recording
- Manage **patch and vulnerability** programs under change windows, compensating controls, and vendor SLAs
- Scope **ICS-aware monitoring** — passive taps, DPI for Modbus/DNP3/OPC/BACnet (high level), baselines
- Author **safety-first OT incident response** — coordination with operations, process safety, and IT IR
- Map **IEC 62443** and **NIST SP 800-82** concepts to gaps, SL-T targets, and remediation priorities
- Produce **hardening roadmaps** and evidence packs for audits, insurers, and leadership (not legal advice)
- Assess **IT/OT convergence** risks — shared AD, cloud historians, remote ops, supply chain

## When NOT to Use

- Generic **corporate network pentest** without OT methodology → `network-pentester`
- **Web application** or API testing → `web-pentester`
- **Authorized exploitation** and red-team validation on IT paths → `penetration-tester`
- **HIL bench**, automotive ECU, or embedded fault-injection testing → `hardware-in-the-loop-security-tester` (complement for lab validation)
- **Enterprise GRC program**, audit prep, or vendor questionnaires without OT lens → `compliance-specialist`
- **SOC alert triage** and corporate detection playbooks only → `soc-analyst`
- **IT-centric incident command** without process-safety and operations coordination → `incident-responder`
- **Corporate SIEM/EDR/IdP** implementation without OT architecture → `information-security-engineer`
- **Security strategy and board metrics** without OT program delivery → `cybersecurity`
- **Control-by-control evidence automation** for IT SOC 2 → `compliance-engineer`
- **Proactive threat hunting** on corporate IT telemetry only → `threat-hunter`

## Related skills

| Need | Skill |
|---|---|
| Corporate security program, policies, board narratives | `cybersecurity` |
| SIEM/EDR/IdP/PAM for enterprise IT stack | `information-security-engineer` |
| GRC program, framework scoping, audit coordination | `compliance-specialist` |
| Technical compliance evidence and control automation | `compliance-engineer` |
| Active IT IR war room, containment, legal coordination | `incident-responder` |
| SOC queue triage and corporate playbooks | `soc-analyst` |
| Hypothesis-driven hunts on IT endpoints/logs | `threat-hunter` |
| Authorized pentest and exploit validation | `penetration-tester` |
| Network/AD/infra pentest from corp paths | `network-pentester` |
| Web/API OWASP testing | `web-pentester` |
| HIL, bus injection, automotive/industrial bench safety | `hardware-in-the-loop-security-tester` |

## Core Workflows

### 1. Scope, safety, and governance

Define OT boundaries, safety constraints, roles, and handoffs with operations and IT.

**See `references/scada_ics_scope_and_safety