Semiconductor Fab Cyber-Resilience Leader — Advanced Memory

The mandate

Malware on a metrology support server interrupted recipe validation and exposed uncontrolled maintenance trust across production tools. Shared vendor accounts, unrecorded laptop connections and unsupported operating systems create pathways between tool families that architecture diagrams classify separately. The fab security leader was removed when recovery evidence could not distinguish clean systems from merely available ones or connect cyber state to wafer disposition.

The interim starts within three weeks for eighteen months across the Seoul campus, Busan suppliers and Tokyo OEM sessions. Initial weeks require direct authority over affected metrology restoration, followed by a weekly fab cyber-production forum. Permanent recruitment begins in month thirteen; eight weeks of overlap follow, with extension possible only when the selected successor's notice period crosses the planned end.

Handover requires trusted baselines for critical tool families, segmented supplier access, exercised manual production continuity, validated restore paths, closed high-risk dependencies and successor ownership of one fab-risk cycle. Baselines must include recipes, host software and approved communications, while restoration exercises must reconcile tool output to quality evidence before release.

The leader may isolate support systems, suspend remote maintenance, set recovery gates and redirect the approved KRW 18 billion programme. The leader can require an OEM to use supervised local access or repeat its integrity evidence before reconnection. Wafer disposition, tool replacement, permanent hiring and production shutdown beyond delegation remain manufacturing or board decisions.

Process recipe development, yield improvement and enterprise office security are excluded. Process engineers retain technical ownership of recipes and equipment performance, and quality retains product disposition. The assignment protects manufacturing trust and recoverability without directing semiconductor process engineering or absorbing the broader factory-automation roadmap.

Why this seat is open

The interruption exposed hidden cyber dependency inside specialised tools. Former leadership equated uptime with clean recovery. The board needs executive authority across security, equipment and continuity until durable succession.

What you will own

• Map critical tool, metrology, recipe, dispatch, identity, network and supplier-access dependencies by production and quality consequence.
• Establish trusted host software, configuration, recipes, controller logic and communications baselines by equipment family.
• Segment maintenance pathways with recorded, expiring and attributable access.
• Define recovery sequences around contamination, metrology confidence, wafer quality, dispatch dependencies and production constraints.
• Exercise tool loss, compromised supplier access, support-network isolation and fab-wide identity disruption under realistic shifts.
• Quantify material cyber concentration across OEMs, shared services, field laptops, remote gateways and unsupported platforms.
• Transfer approved baselines, exercise findings, exceptions and investment decisions through two successor-chaired fab reviews.

Candidate qualifications

• Held semiconductor fab cybersecurity or manufacturing-resilience authority inside continuous high-value production.
• Led cyber recovery involving process tools, metrology, recipe management or manufacturing execution dependencies.
• Can evidence safe software and configuration baselining of vendor-managed specialist equipment without disrupting qualification.
• Governed remote OEM maintenance, field laptops and shared support infrastructure under high-availability production pressure.
• Integrated cyber recovery and reconnection evidence with wafer quality, metrology confidence and contamination controls.
• Handed a multi-quarter fab security programme, tested baselines and supplier exceptions to permanent leadership.

Non-negotiables

• Available within three weeks for full fab-centred presence.
• Independent of incumbent semiconductor equipment and security vendors.
• Will respect manufacturing quality and shutdown authorities.
• Has director-level cyber responsibility inside live semiconductor production.

1. 49 words maximum. State your availability and one fab cyber interruption you governed.
2. 49 words maximum. What proves a vendor-managed tool is clean rather than merely operational?
3. 49 words maximum. Describe a remote-maintenance route you suspended under production pressure.