OT/ICS Incident-Containment Authority — Gulf Coast Chemicals

The mandate

The producer requires one accountable operational-risk decision maker to unify plant managers and enterprise responders under a tested industrial-security regime.

The interim must mobilise in Houston within ten days for nine fixed months, rotating weekly through Lake Charles and Corpus Christi. Permanent recruitment begins after forensic scoping and the first safe-network release; five weeks of overlap are reserved, with no extension if remediation falls behind.

Handover requires independently validated eradication, rebuilt engineering access, Purdue-aligned segmentation across all three sites, recovered asset and logic baselines, two successful vendor-access drills and a successor who has chaired a plant cyber-safety review. Production restart alone is insufficient.

The leader may isolate zones, revoke remote access, quarantine engineering assets, approve emergency specialists within $3 million and delay restart when cyber evidence is inadequate. Unit shutdown beyond seventy-two hours, permanent hires, control-system replacement and regulator representations require COO or board approval; process-safety authority remains with site leaders.

Enterprise email security, commercial ERP and long-range plant automation are excluded. The assignment covers industrial containment, trustworthy recovery and enduring access control, while operations owns throughput and engineering owns process design. Interfaces with excluded systems must still be recorded wherever they can recreate an industrial trust path.

Why this seat is open

The intrusion disproved assurances that industrial and corporate environments were meaningfully separated. The former leader's departure removed authority at the point of highest restart pressure. The board needs an operator who can unite cyber evidence with process-safety decisions and leave after controls survive live use.

What you will own

• Establish the incident chronology across identity, vendor laptop, jump infrastructure, historian and affected controllers using preserved evidence.
• Decide which zones remain isolated or return to service against explicit cyber, process-safety and recovery gates.
• Rebuild privileged engineering access with named sponsorship, session recording, expiring credentials and emergency revocation.
• Direct asset discovery and golden-configuration capture without unsafe active scanning of fragile industrial protocols.
• Segment plant conduits around required data flows, documented exceptions and tested fail-safe behaviour.
• Exercise vendor compromise and loss-of-view scenarios with operators, safety leaders and incident responders.
• Transfer investigation records, zone decisions, residual risks and the plant assurance calendar to the successor.

Candidate qualifications

• Held industrial cybersecurity authority across live chemical, energy or comparable continuous-process plants.
• Led containment where enterprise compromise reached operational technology without causing an unsafe shutdown.
• Can evidence secure restoration of control-system logic, engineering workstations and historian trust from verified baselines.
• Governed OEM and maintenance-provider remote access across multiple sites with emergency operational needs.
• Presented cyber restart evidence jointly with process-safety leaders to executive or regulatory scrutiny.
• Completed time-bound transfer after an industrial incident rather than remaining as a generic transformation lead.