GDS Cyber - CAOE - Staff - AI IT OT Network and Infrastructure Security

What matters most

• Secure hybrid IT, cloud and OT architecture

  The role calls for network and infrastructure security strategies, Zero Trust, IEC 62443-aligned OT controls, segmentation, secure remote access and cloud network protection. Prepare to explain how these controls fit together across environments.

• Apply AI to OT visibility and risk reduction

  EY specifies anomaly detection in OT traffic and industrial protocols, device baselines for PLCs, HMIs and IoT/IIoT assets, and AI-assisted PLC code review. Focus preparation on what each approach could detect and where human validation is needed.

• Improve detection and incident response

  Duties include AI/ML-based intrusion and lateral-movement detection, rule optimization, continuous monitoring, and GenAI prompts for investigation, log analysis and threat intelligence enrichment. Prepare to connect detections to actionable response and alert quality.

• Deliver repeatable client work

  The posting calls for reference architectures, accelerators and runbooks, alongside managing scope, quality, risks and escalations and transferring knowledge. Prepare examples of clear technical documentation and decisions communicated to clients and teams.

Likely challenges to think through

• Security changes versus OT continuity

  Preparation hypothesis: segmentation, remote-access controls or adaptive policies may need careful validation to avoid disrupting industrial processes. Be ready to describe a staged change approach, including asset and traffic baselines, testing and rollback.

• AI detection versus dependable decisions

  Preparation hypothesis: unusual OT behavior and AI-generated investigation leads may be difficult to distinguish from benign changes or unsupported conclusions. Prepare to discuss baselines, false-positive review and human verification before response actions.

• Consistent controls across vendors

  Preparation hypothesis: integrating the listed OT tools, firewalls, secure-access platforms and cloud controls could make policy consistency and visibility difficult. Prepare a method for mapping control intent, identifying coverage gaps and documenting integration boundaries.

• Reusable methods versus client-specific needs

  Preparation hypothesis: reference architectures and runbooks save delivery effort, but may not fit every client's OT environment or scope. Prepare to explain what can be standardized, what needs local validation and when to escalate a delivery risk.

Topics to prepare

• Zero Trust and OT segmentation

  The role calls for Zero Trust, IEC 62443-aligned controls, DMZ architecture and segmentation. Sketch enterprise-to-OT trust boundaries and explain how remote access to a PLC would be restricted.

• Network and secure-access controls

  The posting names NGFW, NAC, VPN, ZTNA, SSE/SASE and DNS security. Revise the purpose of each, then choose controls for a hypothetical contractor-access scenario and explain the trade-offs.

• OT assets, protocols and vulnerabilities

  The role covers PLCs, HMIs, IoT/IIoT assets, OT vulnerability management and Modbus, DNP3 and OPC traffic. Trace a hypothetical abnormal device interaction and identify what evidence would distinguish it from expected operations.

• AI-assisted detection and response

  The posting specifies anomaly detection, device baselines, rule optimization, lateral-movement analysis and incident response. Compare a simple traffic baseline with an alert rule, then explain how you would check an AI-generated finding before escalating it.

• Hybrid infrastructure and integration

  Required knowledge includes VMware virtualization security, XDR and multi-vendor integration across IT, OT and cloud; responsibilities also name CASB, CSPM and cloud network protection. Draw a high-level map of where those controls produce or consume security findings.

Skills to revise

• Review a firewall and access policy

  The posting specifies hands-on NGFW knowledge and secure access. On a hypothetical enterprise-to-OT connection, draft a narrowly scoped allow rule, identify logging and review points, and explain how you would test it without disrupting OT traffic.

• Triage OT device behavior

  Device profiling and AI-driven OT anomaly detection are stated responsibilities. Using an invented PLC/HMI traffic timeline, mark baseline behavior, unusual activity and the additional context needed before calling it an incident.

• Validate GenAI-assisted investigation

  The role calls for prompts supporting log analysis, incident investigation and threat-intelligence enrichment. Draft a prompt that requests evidence citations and uncertainties, then list the log checks needed to verify its output.

• Review PLC logic securely

  AI-assisted PLC code review is named in the posting. Walk through a hypothetical logic change, flag a possible anomaly or misconfiguration, and describe how you would seek operational validation rather than treating an AI suggestion as proof.

• Write a reusable response runbook

  The role includes runbooks, documentation, knowledge transfer and technical escalations. Draft a one-page OT anomaly runbook covering evidence to collect, decision points, escalation and scope or risk notes.

• Prepare an IT/OT security project walkthrough

  Select one relevant example and document your contribution, the environment, controls used, decisions made and results. The role emphasizes practical network security engineering, detection engineering and OT risk reduction; label any hypothetical elements clearly.

• Sketch a segmented IT/OT architecture

  As a practice exercise, draw enterprise, cloud and OT zones with a DMZ, secure remote access and PLC protections. Explain how Zero Trust and IEC 62443-aligned controls would guide segmentation without disrupting industrial operations.

• Map your evidence to the required technologies

  Make a short matrix distinguishing hands-on experience from conceptual knowledge across NGFWs, VMware security, SSE/SASE, OT security tools, XDR and multi-vendor integration. The posting names these areas; do not imply experience you cannot substantiate.

• Walk through an OT detection scenario

  Prepare a hypothetical Modbus, DNP3 or OPC traffic anomaly: identify the baseline, detection logic, possible false positives, investigation steps and safe response. Explain where AI-assisted device profiling could help and where analyst validation is needed.

• Demonstrate a bounded GenAI security workflow

  Draft a sample prompt for incident investigation or log analysis, plus an example of how you would check its output against source evidence. The role calls for prompt engineering, AI-assisted monitoring and security-rule optimization.

• Bring a reusable delivery artifact

  Prepare a one-page runbook or reference-architecture excerpt showing assumptions, scope, risks, escalation points and handover notes. This aligns with the posting’s emphasis on reusable assets, client delivery and knowledge transfer.

• Write questions about delivery priorities

  Ask which IT/OT environments and security controls need attention first, how AI-assisted findings are validated, and what a Staff professional is expected to own versus escalate on client engagements.