Job Description

In the area of Operational Technology (OT) Security, KPMG has established a fast expanding practice servicing the Critical Information Infrastructure (CII) sectors, covering technology transformation, security assessments / testing and cyber incident response. We are growing our team to serve our local and regional clients.

In the area of Internet of Things (IoT), KPMG is establishing an IoT testing laboratory to provide certified labelling services for IoT devices, as well as set up an IoT federated laboratory for the purpose of testing, training, and marketing.

The security professional will work closely with KPMG cyber security subject matter experts to design, implement, test and support solutions for KPMG\'s clients. The Security Professional may also need to support incident response and handling, as required, including investigating computer and network intrusions, and remediation support.

Responsibilities:

Candidate shall have proven experience protecting or implementing OT technology in critical infrastructure and key resource sectors such as Energy, Water, Oil & Gas, Maritime, Aviation, Healthcare, Transportation or Telecommunications.

Alternatively, the candidate shall have proven experience in testing services for IoT technology.

The ideal OT candidate shall possess an understanding of OT fundamentals and cybersecurity practices, including but not limited to:

• Distributed control system (DCS), Programmable Logic Controllers, and supervisory control & data acquisition (SCADA) systems;
• OT protocols common in OT environments;
• Policies, and standards governing the security operations for ICS equipment and networks; and
• OT related international and national regulatory standards e.g. IEC 62443

• Common IoT protocols and standards e.g. WiFi. IEEE 802.11, BLE, Zigbee
• Common IoT security technology e.g. WPA/WPA2/PSK encryption,
• Firmware binary analysis, secure code review, static analysis, dynamic analysis, fuzz testing, penetration testing
• Testing of hardware e.g. embedded systems, circuit boards and interfaces
• Familiar with IoT/lab testing related codes and standards e.g. ETSI EN 303 645, IMDA IoT Cyber Security Guide, ISO/IEC 17025, SAC-SINGLAS, ISO/IEC 15408 Common Criteria etc.
  

• Minimum of 3 years relevant experience in OT/IoT environment with a track record of successful accomplishments and a willingness to learn;
• Understanding of IT/OT/IoT communication protocols e.g. TCP/IP, UDP, DNP3, Modbus, IEC 61850, OPC, OPC UA, PROFINET, BLE, Zigbee.
• Understanding of threats, vulnerabilities, and exploits in OT/IoT environments and appropriate mitigation techniques;
• Excellent verbal and written communication skills;
• Effective interpersonal skills;
• Ability to lead, motivate, and participate as a team player;
• Creative problem solver mindset;
• Understanding of operating systems, network/system architecture, and IT architecture design preferred; and GICSP, GRID, GCIH, or other relevant industry certifications preferred.
• Preferably possess relevant industry certifications for OT such as IEC62443, GICSP, GRID, etc.
• Preferably possess professional penetration testing certifications such as OSCP, CREST and/or GIAC (GXPN, GPEN, GWAPT, GAWN etc.)