Understand what changes in an OT environment
OT systems monitor or control equipment and processes in the physical world. Cybersecurity work must account for the effect a change could have on availability, reliability, and safety. NIST’s Guide to Operational Technology Security explains common system types, architectures, threats, and safeguards. Read it to build vocabulary and ask better questions; do not treat a guide as permission to probe or alter a live system.
Learn the basic layers and purpose of industrial control systems: sensors and actuators, controllers such as PLCs, supervisory systems, operator interfaces, historians, engineering workstations, and the networks that connect them. You do not need to become a process engineer before pursuing an entry point, but you should understand that these components support real operations and have owners responsible for safe change.
Build on transferable IT skills
Start by strengthening fundamentals you can demonstrate: TCP/IP, routing and switching, Windows and Linux administration, identity and access management, endpoint and network logs, backups, vulnerability handling, incident documentation, and clear communication. These foundations help you understand industrial network diagrams and support the security team without claiming expertise you have not yet earned.
Then add OT-specific concepts: segmentation and conduits, controlled remote access, asset inventory, change management, vendor support boundaries, maintenance windows, and how incident response coordinates with operations. The CISA and partner agencies’ asset inventory guidance offers a concrete exercise: learn what data makes an inventory useful, why scope and ownership matter, and how to record unknowns instead of presenting guesses as facts.
Use a staged learning plan
- Map your baseline. List the IT tasks you have performed and the evidence for each: tickets resolved, systems supported, networks documented, incidents handled, or procedures improved.
- Study the environment. Read NIST SP 800-82, review introductory control-system architecture material, and learn the roles of operators, control engineers, IT, safety, and security teams.
- Practice safely. Use a lab or simulation designed for learning. Build a small network diagram, inventory sample assets, write a remote-access review, or document a tabletop incident. Never test against a real utility or industrial network without explicit authorization and supervision.
- Seek adjacent assignments. Look for work in network operations, vulnerability coordination, identity, asset management, security operations, or industrial vendor support where you can learn under experienced practitioners.
- Show your reasoning. Create sanitized work samples that explain assumptions, risks, approvals, and handoffs—not just tool screenshots.
Use role frameworks to target learning
NIST’s NICE Framework provides a shared language for cybersecurity work. In 2025, NIST introduced an Operational Technology (OT) Cybersecurity Engineering work role in its components. The framework’s value is not a promise that every employer uses the same title. It helps you compare actual tasks and skill statements across job descriptions and identify gaps in your own experience.
Search for role names such as OT security analyst, industrial cybersecurity technician, control systems security analyst, network security analyst supporting manufacturing or utilities, and OT cybersecurity engineer. Read the duties carefully: “engineer” can mean design authority in one organization and implementation support in another. Prioritize roles whose required work matches your demonstrated skills, then explain the next skill you are building.
Make your application credible
Translate help-desk accomplishments into outcomes without inflating them. “Resolved access issues” can become “administered account access under documented approval procedures and recorded exceptions.” “Helped with a network migration” can name your specific contribution, tools, and coordination. Be precise about whether you observed, assisted, configured, or owned a task.
In an interview, show respect for authorization and operational safety. A strong candidate knows when to pause, involve the system owner, follow change control, and communicate uncertainty. In OT security, careful execution and trust are part of technical competence.