Operational Technology (OT) Security (Public Sector)

At Xtremax, we are looking for IT Security Officer (Operational Technology) supporting the Meteorological Service Singapore (MSS), responsible for securing operational technology (OT) infrastructure supporting weather observation, forecasting, and dissemination systems. The role focuses on OT cybersecurity, security operations, vulnerability management, compliance, and protecting mission-critical meteorological systems.

Position Overview

The IT Security Officer is responsible for protecting the integrity, availability, and confidentiality of key operational technology infrastructure within the Meteorological Service Singapore. This role bridges cybersecurity expertise with an understanding of specialized environmental monitoring technologies, ensuring that weather observation, forecasting, and dissemination systems remain secure, resilient, and compliant with national standards.

Key Responsibilities

OT Asset Discovery & Architecture Mapping

• Use passive, non-disruptive monitoring tools to discover OT assets across meteorological networks without impacting live operations.
• Maintain a comprehensive OT Asset Register covering all hardware, firmware, software, and network connectivity. Flag all shadow or unmanaged devices.
• Review and document the IT/OT network architecture, producing topology diagrams that capture OT-to-IT connectivity, remote access paths, vendor interfaces, and boundary crossing points, each risk-rated.
• Map operational data flows between OT and IT systems to identify lateral attack paths, including where meteorological process data crosses into less-secure corporate network segments.
• Maintain the OT Asset Register and IT/OT Network Architecture Map as the foundational security baseline for all vulnerability assessments, risk management, and incident response activities.

Security Operations & Monitoring

• Monitor and defend operational technology (OT) supporting meteorological systems, including weather radar networks (e.g., Doppler Weather Radar S/C Bands), satellite ground stations, upper-air sounding systems, and automated weather observation systems (AWOS).
• Operate and maintain security information and event management (SIEM) tools to detect anomalies across hybrid IT/OT environments.
• Work closely with the Agency’s CISO to manage and deploy critical patches and others security incidents.
• Investigate and respond to security incidents, coordinating with national CERT teams and agency leadership as required.

Risk Management & Compliance

• Conduct regular risk assessments across meteorological data acquisition, processing, and dissemination pipelines.
• Ensure compliance with relevant frameworks such as NIST SP 800-82r3, FISMA, ICS/SCADA security standards (IEC 62443), and agency-specific cybersecurity policies.
• Maintain and test the division’s continuity of operations plans (COOP) and disaster recovery procedures to ensure minimal disruption to critical weather services.

Vulnerability Management

• Perform and coordinate regular vulnerability scans, penetration tests, and security audits of systems.
• Manage patch cycles in close coordination with systems engineers, balancing security needs against the 24/7/365 operational uptime requirements of weather services.

Vendor & Supply Chain Security

• Evaluate third-party hardware and software used in meteorological systems (sensors, data feeds, vendor-supplied processing software) for supply chain risks.
• Review and enforce security requirements in contracts with technology vendors and data partners.

Training & Security Awareness

• Develop and deliver cybersecurity awareness training tailored to the division’s operational context, including threats specific to environmental monitoring infrastructure.
• Serve as the primary OT security expert for the division.

Required Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• Minimum 5 years of experience in IT/OT security roles, preferably within critical infrastructure, government, or scientific/technical environments.
• Proficiency with SIEM platforms, intrusion detection/prevention systems (IDS/IPS), and endpoint detection tools.
• Active or ability to obtain a government security clearance at the required level.

Preferred Qualifications

• Familiarity with meteorological systems, remote sensing technologies, or environmental monitoring infrastructure.
• Demonstrated experience securing SCADA, ICS, or OT systems.
• Strong working knowledge of NIST, FISMA, and IEC 62443 frameworks. • Experience working within a 24/7 mission-critical operational environment.
• Knowledge of WMO (World Meteorological Organization) data standards and international weather data sharing protocols.
• One or more active certifications: CISSP, CISM, CEH, GICSP, or equivalent.
• Experience with cloud security in hybrid environments (AWS, Azure Government).

Note:

• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
• CEH (Certified Ethical Hacker)
• GICSP (Global Industrial Cyber Security Professional) — highly valued for OT/radar network security.

Advantage Skill Sets

• Knowledge of raw meteorological data ingestion pipelines (e.g., BUFR, GRIB, NetCDF formats, IWXXM, GeoJSON)

Soft Skills & Attributes

• Calm Under Pressure: Ability to make critical security decisions rapidly during severe weather events when systems are under maximum operational stress.
• Strong Communication: Ability to translate complex cyber threats into actionable advice for non-technical meteorological staff and agency executives.
• Analytical Mindset: Exceptional problem-solving skills with a keen eye for detecting anomalies in massive data workflows.

Data Protection Notice

By submitting your application and resume, you consent to Xtremax Pte. Ltd. collecting, using, and disclosing your personal data for recruitment and employment evaluation purposes in accordance with the Personal Data Protection Act (PDPA).