Job Description Everforth ECS is seeking an
OT Control Assessor to work in our
Portland,OR office.
Please Note: This position is contingent upon contract award. The Operational Technology (OT) Control Assessor supports the execution of security and risk control assessments across industrial control systems, OT networks, cyber-physical systems, and mission or facility environments. This role evaluates the design, implementation, and operating effectiveness of technical, administrative, and operational controls while accounting for safety, reliability, availability, and operational continuity requirements.
The ideal candidate has hands-on cybersecurity, control assessment, or OT/ICS experience; understands how security controls apply in operational environments; and can conduct evidence-based testing while collaborating with engineers, operators, system owners, and cybersecurity stakeholders.
Key Responsibilities OT Control Assessment & Testing - Perform assessments of security and risk controls across OT systems, industrial control systems, supervisory control and data acquisition environments, distributed control systems, building automation systems, and related support infrastructure.
- Evaluate control implementation, design effectiveness, and operating effectiveness using approved assessment methodologies and procedures.
- Execute control testing through interviews, documentation reviews, configuration or architecture reviews, evidence analysis, and validation of operational procedures.
- Collect, review, and validate assessment evidence while minimizing disruption to production, safety, mission, or facility operations.
OT/ICS Environment Analysis - Review OT architecture, network segmentation, data flows, asset inventories, trust boundaries, remote access paths, vendor access, logging coverage, and interfaces between enterprise IT and OT environments.
- Assess operational practices related to change control, patching, vulnerability management, backup and recovery, incident response, account management, physical access, and configuration management in OT environments.
- Identify control gaps, compensating controls, operational constraints, and risk tradeoffs that affect OT security, resilience, and mission continuity.
Framework & Standards Alignment - Assess OT controls against applicable frameworks, standards, and organizational baselines such as NIST, NIST SP 800-82, IEC 62443, NERC CIP, CIS Controls, ISO 27001/27002, and program-specific requirements.
- Map OT control implementation and supporting evidence to applicable assessment objectives, regulatory requirements, contractual requirements, and risk management expectations.
- Distinguish between enterprise IT control expectations and OT-specific constraints, compensating controls, safety requirements, and availability requirements.
Analysis & Documentation - Document assessment activities, evidence reviewed, testing approach, assumptions, limitations, and results clearly and accurately.
- Develop or contribute to OT-focused findings, risk statements, evidence summaries, and remediation recommendations.
- Support corrective action planning by recommending practical, risk-informed improvements that account for operational feasibility and system lifecycle constraints.
- Maintain assessment workpapers and artifacts in accordance with program quality, audit-readiness, and evidence-handling expectations.
Stakeholder Collaboration - Work with OT engineers, control system operators, system owners, cybersecurity teams, facility personnel, vendors, and business stakeholders to understand control implementation and operational context.
- Clarify assessment requirements, evidence needs, site coordination requirements, and testing expectations with technical and operational personnel.
- Support presentations, status updates, and briefings of OT assessment results as requested by assessment leads or program leadership.
Risk, Safety & Compliance Support - Apply approved methodologies consistently to ensure assessment results are accurate , repeatable, defensible, and sensitive to safety and operational priorities.
- Escalate significant control gaps, evidence limitations, safety concerns, availability impacts, or cyber-physical risk issues to assessment leadership.
- Support audit readiness, compliance reporting, risk register updates, remediation tracking, and follow-up assessment activities for OT environments.
Continuous Improvement - Assist with improving OT assessment methodologies, checklists, templates, tools, evidence requests, and reporting processes.
- Participate in lessons-learned activities, reassessments, and process improvement initiatives.
- Stay current with evolving OT cybersecurity threats, control frameworks, regulatory requirements, assessment practices, and industry best practices.
Required Skills - 3-5 years of experience in cybersecurity, risk management, compliance, audit, control assessment, OT security, industrial control systems, or related technical roles.
- Experience supporting or executing formal control assessments, audits, compliance reviews, cybersecurity evaluations, or OT security assessments.
- Working knowledge of security control frameworks and OT-relevant guidance such as NIST, NIST SP 800-82, IEC 62443, CIS Controls, NERC CIP, ISO, or organizational control baselines.
- Ability to analyze OT architecture diagrams, network diagrams, system security documentation, policies, procedures, configurations, and operational evidence.
- Understanding of OT risk considerations, including safety, availability, reliability, segmentation, remote access, vendor access, patching constraints, and lifecycle limitations.
- Strong written documentation skills, including the ability to develop clear findings, evidence summaries, and risk statements.
- Ability to communicate effectively with technical, operational, and non-technical stakeholders.
Desired Skills - Experience in regulated, critical infrastructure, industrial, manufacturing, energy, utilities, transportation, healthcare, government, or defense environments.
- Familiarity with OT or ICS technologies such as SCADA, PLCs, DCS, HMIs, historians, engineering workstations, serial-to-IP gateways, industrial protocols, and OT monitoring tools.
- Experience assessing technical, administrative, physical, and operational controls across OT, enterprise IT, and hybrid IT/OT environments.
- Familiarity with system security artifacts such as SSPs, policies, procedures, POA&Ms, risk registers, architecture diagrams, asset inventories, network diagrams, and audit evidence repositories.
- Certifications such as Security+, GICSP, GRID, GCIP, CISA, CRISC, CISSP, CAP, CGRC, ISA/IEC 62443, or equivalent experience.
ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.
Everforth ECS is the federal segment of
Everforth , a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies.
Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.
We value:
- Attracting and developing top talent and high-performing teams
- Fostering a culture that is engaging, accountable, and mission-driven
Meet the challenge. Make a difference with Everforth ECS! 
Never miss an opportunity! Create an alert based on the job you applied for.