Hitachi Rail is looking for an enthusiastic self-motivated Principal OT Cybersecurity Engineer who thrives in a fast-paced environment. The successful candidate is comfortable performing a wide range of tasks from administrative to strategic. The position is based in Brisbane, Australia.

The Principal OT Cybersecurity Engineer leads and executes high‑complexity cybersecurity engineering tasks, coordinates technical project activities, ensures compliance with international standards (IEC 62443, CLC/TS 50701, NIST, ISO 27001), and supports integration, validation, and assurance of cybersecurity controls across all OT and railway subsystems.

This role bridges architecture, engineering, and technical project management; supporting the Cybersecurity Manager while guiding and mentoring Cybersecurity Specialists.

Key accountabilities:

Technical Authority for OT Cybersecurity

- Act as the senior technical reference point for engineering teams and suppliers.

- Approve technical security solutions, architectures, and design proposals.

- Review and validate compliance with IEC 62443-3-3, 4-1, 4-2 security requirements.

- Provide expert guidance on secure system architecture, zoning/segmentation, OT protocol security, and secure integration of critical systems.

Cybersecurity Engineering & Design

Lead and participate in the development of:

- System Security Requirements (SRs)

- Zones & Conduits architecture

- Network and security architecture (IT/OT)

- Secure configuration baselines and hardening guidelines

- Security integration plans for signalling, telecom, SCADA, and control systems

- Assess vendor solutions against technical and security requirements.

- Identify gaps and propose technical remediations aligned with program constraints.

In addition…

- Risk Assessment & Cybersecurity Assurance

- Implementation & Integration of Cybersecurity Technologies

- Testing, Validation & Acceptance

- Technical Project Management

- Documentation, Reviews & Stakeholder Interaction

Required skills and knowledge:

- Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Systems Engineering, or related STEM disciplines.

- Master’s degree in Cybersecurity, Systems Engineering, Information Assurance, or related disciplines preferred.

- 6–10 years of experience in Cybersecurity engineering within OT/ICS environments, transportation, energy, utilities, or other critical infrastructure.

- Demonstrated hands on experience implementing, validating, and troubleshooting OT security solutions.

- Experience contributing to or leading technical project management activities.

- Experience in railway, metros, high‑speed lines, or transportation systems.

- Knowledge of local regulations and cybersecurity frameworks in various regions

- (e.g., NIST, ENISA, APAC critical infrastructure frameworks, Middle East national cybersecurity frameworks).

- Experience in SOC integration and operational handover.

- Cloud or hybrid architecture for operational environments.

- IEC 62443 (required)

- CLC/TS 50701 (required for railway related deployments)

- NIST 800 82 / 800 53

- ISO 27001 / ISO 27005

At Hitachi Rail, we know that a diverse business is a sustainable business. Working collaboratively with a range of internal networks, we’re continuously improving our policies and products. From accessible, sustainable design to achieving a better gender balance. We base these efforts on our core values: Harmony, Sincerity, and Pioneering spirit. And by aligning with these, we’re able to create a workplace where people not only feel comfortable but are given opportunities to thrive. We’re especially keen to hear from women and people of all genders considering a career in engineering, cybersecurity, and rail technology.

What we offer:

- Annual performance, development, and salary review process.

- Ongoing professional development and training.

- Salary continuance.

- Health and Wellbeing initiatives throughout the year (incl. flu vaccinations).

- Employee Assistance Program (employees and family).





- Days off per year sponsored by the company in addition to the statutory public holidays and leave entitlements.

- Invitation to attend and participate in Company sponsored social events throughout the year.

- Additional Job Description

Mission

Designs, implements, integrates, and validates complete OT cybersecurity infrastructure for railway and other critical-infrastructure projects. The role combines ownership of security architecture with hands-on engineering, ensuring that platforms and controls meet project requirements, international standards, and applicable Australian regulatory obligations. Acting as the technical authority for security platforms, the role supports the full lifecycle from concept and detailed design through testing, commissioning, operational handover, and ongoing assurance.

Key Responsibilities / Accountabilities

- Architecture and technical authority: Define end-to-end, vendor-agnostic OT cybersecurity architectures using zones and conduits, defence in depth, secure segmentation, high availability, and resilient design principles. Establish reusable technical standards, reference architectures, and integration patterns across projects and regions.

- Platform design and implementation: Lead the design, configuration, integration, and validation of network and perimeter security, identity and access management, threat detection, SOC-enabling technologies, data protection, cyber recovery, and secure core IT/OT infrastructure.

- Standards and assurance: Translate IEC 62443, CLC/TS 50701, NIST, and ISO requirements into practical controls. Maintain traceability from requirements and risk assessments through architecture, implementation, testing, and assurance evidence.

- Testing and commissioning: Define and execute security FAT and SAT activities, hardening and configuration checks, functional control tests, and integration tests with OT subsystems. Support vulnerability reviews, remediation, Security Case inputs, and operational acceptance.

- Technical coordination: Coordinate with OT, network, systems, SOC, vendor, and systems-integration teams. Plan technical work, manage dependencies and interfaces, identify delivery risks, and provide clear progress reporting.

- Regulatory alignment and leadership: Adapt designs to Australian critical-infrastructure, cybersecurity, data-protection, and logging obligations while preserving reusable architectural principles. Mentor engineers and influence multidisciplinary design decisions.

Performance Criteria

- Produces secure, supportable OT cybersecurity architectures that meet agreed project, safety, availability, and lifecycle requirements.

- Delivers configured and validated security platforms with clear evidence of requirements coverage, hardening, testing, and defect resolution.

- Identifies technical risks, dependencies, and integration issues early and drives practical resolution across multidisciplinary teams.

- Maintains high-quality architecture, configuration, test, and handover documentation suitable for assurance and operations.

- Works independently as a trusted technical authority while mentoring engineers and communicating effectively with projects, suppliers, assessors, and operational stakeholders.

Technical Skills & Knowledge

- OT cybersecurity architecture and design: Expert knowledge of defence-in-depth architecture, IEC 62443 zones and conduits, security-level allocation, trust boundaries, secure segmentation, industrial DMZs, high-availability patterns, resilience, and secure integration of legacy and modern OT systems.

- Standards, risk, and assurance: Strong practical application of IEC 62443, CLC/TS 50701, NIST SP 800-82 and SP 800-53,



ISO 27001 and ISO 27005. Ability to translate risk assessments, threat models, regulatory obligations, and security requirements into implementable controls, traceable designs, test evidence, and Security Case inputs.

- Network and perimeter security: Advanced design and troubleshooting skills across firewalls, WAFs, proxies, secure gateways, routing, switching, VLANs, VPNs, network access control, remote-access solutions, unidirectional gateways, and multi-vendor OT network environments.

- Identity, access, and privileged security: Detailed knowledge of directory services, IAM, PAM, MFA, PKI, certificates, RADIUS, TACACS+, role-based access control, service accounts, credential management, joiner-mover-leaver processes, and secure administrative access within operational environments.

- Threat detection and security operations: Ability to architect and integrate OT NIDS, EDR/XDR, SIEM, telemetry collectors, log pipelines, time synchronisation, event correlation, retention, integrity protection, alerting, and SOC use cases. Understanding of incident-response workflows, forensic readiness, and operational monitoring requirements.

- Secure infrastructure and platform engineering: Hands-on capability in Windows and Linux hardening, secure configuration baselines, hypervisors, virtualisation, server and storage platforms, patching, vulnerability management, endpoint protection, secure data-centre and control-centre infrastructure, and infrastructure automation where appropriate.

- Data protection, backup, and cyber recovery: Knowledge of encryption, key management, data classification, secure transfer, backup architecture, disaster recovery, cyber recovery, immutable and offline storage, recovery testing, and restoration priorities for safety- and mission-critical services.

- Engineering integration and verification: Strong skills in requirements decomposition and traceability, interface definition, architecture and configuration documentation, hardening guides, design reviews, troubleshooting, FAT/SAT planning and execution, vulnerability remediation, defect management, commissioning, and operational handover.

- Technical leadership and communication: Ability to act as a technical authority, evaluate products and vendor proposals, lead design decisions, mentor engineers, coordinate multidisciplinary teams, manage technical risks and dependencies, and communicate complex cybersecurity matters clearly to engineering, assurance, project, supplier, and operational stakeholders.

Education, Experience & Certifications

Education

- Bachelor’s degree in cybersecurity, computer science, information technology, telecommunications engineering, automation engineering, systems engineering, or an equivalent technical discipline.

- A master’s degree in cybersecurity, information assurance, or systems engineering is desirable.

Essential Qualified Experience

- At least five years of professional experience in IT/OT cybersecurity infrastructure, including responsibility for architecture and deployment.

- Demonstrated delivery experience in railway, transportation, energy, utilities, oil and gas, or another critical-infrastructure environment.

- Hands-on experience designing, configuring, integrating, testing, and commissioning cybersecurity platforms and controls.

- Practical application of IEC 62443, including zones and conduits, defence in depth, security levels, and system and component requirements.

- Experience producing architecture, configuration, hardening, test, assurance, and operational handover documentation.

Rail and Australian Context

- Experience applying CLC/TS 50701 in railway projects.

- Ability to adapt cybersecurity architectures and controls to Australian regulatory, critical-infrastructure, data-protection, and logging obligations.

- Experience engaging with project assurance stakeholders, assessors, regulators, vendors, and systems integrators is desirable.

Desirable Certifications

- CISSP, CISM, or CRISC.

- GIAC GICSP, GRID, or GCIP.

- IEC 62443 cybersecurity certification.

📌 Principal OT Cybersecurity Engineer (Brisbane)
🏢 Hitachi Rail STS Australia
📍 Brisbane