ENGINEERING RELIABILITY. BUILT-IN SECURITY/

We design, optimise, and modernise operational technology (OT) and digital infrastructure, with security and compliance engineered in from day one, not bolted on after.

About the role

The Principal OT Systems Architect is a Technical Design Authority on SOCI-driven engagements. The role turns SOCI Act, CIRMP and AESCSF v2 obligations into control system, network and lifecycle architectures that clients can build and sustain. The role is about 85% architecture and technical delivery and 15% client advisory. The role works as a partner to the Principal OT Operating Model Consultant. The architect decides what the system must be; the consultant decides how the organisation runs it.

Key responsibilities

Architecture and design authority

- Act as technical authority: own design decisions, review technical deliverables and sign off technical quality before issue.

- Assess current-state OT architecture across Purdue levels 0–5: SCADA, DCS, PLC/RTU, HMI, historians, engineering workstations and the IT/OT DMZ.

- Define target-state reference architectures, zone and conduit models, and standardisation options across sites and asset classes.

- Set architecture and integration standards for recent assets (wind, solar, BESS, gas) so they are supportable at handover.

- Lead architecture input to IT/OT separation programs: dependencies, technical sequencing and cutover risk.

OT network architecture

- Own OT network design decisions end to end: topology, segmentation, addressing, routing, redundancy and WAN.

- Design and review zone and conduit implementations, IT/OT DMZ, firewall rule architecture and unidirectional gateway placement.

- Specify redundant control networks (PRP/HSR, rings, dual-homed controllers) and assess failure modes against plant availability.

- Design SCADA WAN and remote site connectivity across MPLS, radio, satellite and 4G/5G, including latency and resilience trade-offs for DNP3, IEC 104 and IEC 61850.





- Design secure remote and vendor access architecture: jump hosts, privileged access, MFA and AD in OT.

- Write network standards and review integrator and OEM network designs; challenge them on technical merit.

Control systems and best practice

- Benchmark control system practice against IEC 62443, ISA-95 and vendor guidance.

- Lead site reviews of technical practice: backup and recovery, patching, obsolescence, remote access and OEM interfaces.

- Build site and capability matrices for PLC, SCADA, network and supporting infrastructure.

SOCI and regulatory alignment

- Make designs demonstrably traceable to SOCI Act, CIRMP, AESCSF v2 and Essential Eight obligations.

- Integrate partner cyber and GRC findings into architecture and remediation design.

- Apply SOCI Protected Information and OT-Sensitive handling rules across technical artefacts.

Asset and lifecycle architecture

- Assess asset inventory quality: visibility, criticality and lifecycle status.

- Develop hardware and software lifecycle strategies, obsolescence plans and technical investment roadmaps aligned to ISO 55000.

Client and delivery

- Lead technical cadence, technical workshops and design reviews.

- Author the target architecture, network design, technical gap analysis and technical sections of the roadmap.

- Mentor engineers and contribute technical scope and estimates to proposals.

Network capability

- The bar is a network design lead, not a CCIE: able to make and defend network architecture decisions without deferring to a specialist.

Essential skills and experience

- 12+ years in industrial automation or OT, with 5+ years as architect,



lead engineer or design authority.

- Hands-on control system architecture across SCADA, DCS, PLC/RTU, HMI and historians in critical infrastructure industries.

- Demonstrated lead-designer experience on OT networks for at least one multi-site critical infrastructure environment.

- Working knowledge of SOCI Act, CIRMP, AESCSF v2 and IEC 62443 as they apply to architecture.

- Brownfield modernisation and IT/OT separation delivery.

- Strong technical writing; able to defend design decisions to engineering leads and executives.

- Eligible to work in Australia; able to obtain site access and background checks (police check, medicals, D&A;).

Desirable qualifications

- Degree in electrical, electronic, mechatronics, instrumentation or control engineering (or equivalent).

- CPEng, NER, or RPEQ for Queensland work.

- Vendor network certification at professional level (e.g. CCNP, Fortinet NSE 4+, Hirschmann or Moxa industrial networking).

- ISA/IEC 62443 Cybersecurity Fundamentals Specialist or Expert, or GIAC GICSP.

- SABSA or TOGAF.

- Australian energy market experience (AEMO, NEM, WEM) and renewable/BESS integration.

- Baseline security clearance or eligibility.

About us

Tier16 is a specialist engineering and automation services company, delivering expert consultation and advisory solutions across a full spectrum of industrial operational technologies.

For industrial and production operations across energy, defence, mining, and utilities, Tier16 bridges the gap between automation engineering and operational security - to design future-ready industrial systems.

Unlike traditional system integrators, we combine industrial automation with Security of Critical Infrastructure compliance expertise.

Tier16 does not discriminate on the basis of race, colour, religion, sex, sexual orientation, gender identity, origin, age or disability and encourage applications from qualified applicants.

📌 Principal OT Systems Architect (Perth)
🏢 Tier Sixteen
📍 Perth