Senior OT Network Security Engineer, Data Centers
Role Overview
Verge Management Group is conducting a confidential retained search for a fast-growing AI cloud provider that runs some of the largest AI workloads in the world across dozens of data centers, many of them operated by colocation partners. They're hiring their first dedicated OT security engineer to own the security of the power, cooling and building systems inside those sites. In a lot of data centers, the systems keeping the GPUs alive (power, cooling, fire, physical access) live in a gray zone. Facilities owns them, a colocation partner runs them, an integrator set them up, and security mostly hopes for the best. This client decided those systems deserve their own owner. It's the first dedicated OT security engineering seat, so there's no inherited program to babysit and nobody else's mess to defend. You'll find out what's actually running in these buildings, decide what "secure enough" means, and then go get the partners there. You'll report to the network security engineering manager, who came up through OT, so you won't spend your first quarter explaining why you can't just push an agent to the BMS. And there's a twist most OT engineers never get. The client sits on a serious amount of AI compute, and you'll be encouraged to point frontier models and agents at OT problems that haven't been solved yet, like continuous, non-intrusive testing across every site. Most places tell you to keep AI away from the control network. Here it's part of the job. Why This One The base is $240K for a hands-on engineering seat. You get a blank page, more compute than most security teams will ever touch, and a manager who already speaks your language. The standard you write becomes the bar every new site gets built to, so your work ends up in the concrete and copper for years after you write it.
The Mission
The Mission: What You'll Do
- ·Walk the sites first. Spend your first few weeks inside five or six data centers learning the baseline, then build the real asset inventory, including the parts that aren't on IP (serial, BACnet MS/TP, Modbus RTU), and turn it into a risk register the team can actually prioritize from.
- ·Write the security standard every data center partner has to meet: segmentation, remote access, monitoring, patching and evidence. Then hold new sites and expansions to it, so each build clears a higher bar than the last.
- ·Assess what partners really have in place, on site when it makes sense, and tell a real control from a slide. A program manager handles coordination and contract language, so you stay on the technical work.
- ·Test without breaking anything, and know what must never be actively scanned. Help move the program from one-time pen tests to continuous, AI-assisted testing, and use telemetry, access logs and network data to catch what humans miss (like the HVAC login on a Sunday that no alarm explains).
- ·Plan for the bad day. Build response playbooks and recovery plans for OT compromise scenarios, and present risk clearly to engineers, executives and partners.
Relevant Skills and Experience
Relevant Skills and Experience: What You Need to Bring
- ·A working command of IEC 62443, Purdue model segmentation and the protocols that actually run a data center (BACnet, Modbus and the rest of the family). The client is firm on this one: if it isn't already part of how you work, your application won't be reviewed.
- ·Hands-on OT security in live production environments. Data centers are ideal. Utilities, manufacturing and other critical infrastructure backgrounds absolutely count.
- ·Fluency with BMS, EPMS, power, cooling, fire and physical access systems, and the networks tying them together.
- ·Real network security depth: segmentation, firewalls, remote access and secure architecture across the IT/OT boundary.
- ·Credibility with people who don't report to you. You've moved suppliers, integrators or operators with evidence and influence, and you can explain OT risk to an engineer, an executive and a partner, in writing and in the room.
Bonus points for time with Claroty, Dragos, Nozomi or Armis (plus an honest opinion on what each one can't see), data center OEM gear from Schneider Electric, Vertiv, Eaton or similar, third-party security assessments, and enough Python to build your own tooling. Missing a few of those? Apply anyway. The client would rather talk to a strong OT practitioner than filter one out.
Job Summary
VMG guarantees strict confidentiality for all applicants.