OT/ICS Incident-Containment Authority — Gulf Coast Chemicals

The mandate

Malware reached a historian through a vendor engineering laptop, forcing one continuous-process unit into manual control and exposing undocumented trust between corporate identity, jump hosts and safety-adjacent assets. The industrial-security director resigned during containment, leaving plant managers and enterprise responders without one accountable operational-risk decision maker.

The interim must mobilise in Houston within ten days for nine fixed months, rotating weekly through Lake Charles and Corpus Christi. Permanent recruitment begins after forensic scoping and the first safe-network release; five weeks of overlap are reserved, with no extension if remediation falls behind.

Handover requires independently validated eradication, rebuilt engineering access, Purdue-aligned segmentation across all three sites, recovered asset and logic baselines, two successful vendor-access drills and a successor who has chaired a plant cyber-safety review. Production restart alone is insufficient.

The leader may isolate zones, revoke remote access, quarantine engineering assets, approve emergency specialists within $3 million and delay restart when cyber evidence is inadequate. Unit shutdown beyond seventy-two hours, permanent hires, control-system replacement and regulator representations require COO or board approval; process-safety authority remains with site leaders.

Enterprise email security, commercial ERP and long-range plant automation are excluded. The assignment covers industrial containment, trustworthy recovery and enduring access control, while operations owns throughput and engineering owns process design. Interfaces with excluded systems must still be recorded wherever they can recreate an industrial trust path.

Why this seat is open

The intrusion disproved assurances that industrial and corporate environments were meaningfully separated. The former leader's departure removed authority at the point of highest restart pressure. The board needs an operator who can unite cyber evidence with process-safety decisions and leave after controls survive live use.

What you will own

• Establish the incident chronology across identity, vendor laptop, jump infrastructure, historian and affected controllers using preserved evidence.
• Decide which zones remain isolated or return to service against explicit cyber, process-safety and recovery gates.
• Rebuild privileged engineering access with named sponsorship, session recording, expiring credentials and emergency revocation.
• Direct asset discovery and golden-configuration capture without unsafe active scanning of fragile industrial protocols.
• Segment plant conduits around required data flows, documented exceptions and tested fail-safe behaviour.
• Exercise vendor compromise and loss-of-view scenarios with operators, safety leaders and incident responders.
• Transfer investigation records, zone decisions, residual risks and the plant assurance calendar to the successor.

Candidate qualifications

• Held industrial cybersecurity authority across live chemical, energy or comparable continuous-process plants.
• Led containment where enterprise compromise reached operational technology without causing an unsafe shutdown.
• Can evidence secure restoration of control-system logic, engineering workstations and historian trust from verified baselines.
• Governed OEM and maintenance-provider remote access across multiple sites with emergency operational needs.
• Presented cyber restart evidence jointly with process-safety leaders to executive or regulatory scrutiny.
• Completed time-bound transfer after an industrial incident rather than remaining as a generic transformation lead.

Non-negotiables

• Available in Houston within ten days for continuous incident availability and plant rotation.
• Independent of incumbent automation, forensic and managed-security vendors.
• Will stop restart when evidence fails even under production pressure.
• Has held director or CISO-1 decision rights in operational technology.

1. 49 words maximum. State your earliest start and one OT restart decision you personally withheld.
2. 49 words maximum. Which artefact would prove a controller's logic can be trusted after compromise?
3. 49 words maximum. Describe a vendor-access pathway you eliminated without impairing maintenance response.