Ot Cybersecurity Manager

Founded in **, Prosolia Energy is a leading business group in the renewable energy sector, with operations in Spain, Portugal, Italy, France, Germany and Mexico.
Prosolia Energy is an Independent Power Producer (IPP) specialised in providing decarbonisation services to our customers.
We control the entire value chain of the projects through which we provide energy to our customers, developing, constructing, operating and maintaining a range of renewable generation and storage sources.
We are committed to leading the transition of the industrial and productive sector towards a decarbonised, sustainable and competitive model.
Our strategic objectives for the coming years include growing our asset base and expansion into new markets and products.
Prosolia Energy now has a project portfolio of more than 4 GW.
In order to build and develop this portfolio, as well as to achieve its strategic objectives, we are looking for talented, high potential professionals who wish to join our team and contribute to our continued success.
We are looking for an OT Cybersecurity Manager to lead and implement cybersecurity strategies across our OT environments, ensuring robust risk management and compliance.

Responsibilities:
1.
Cybersecurity strategyDefine and update the corporate OT cybersecurity strategy, aligned with the objectives of the Prosolia group, the risk strategy and the applicable regulations (IEC *, ISO ***, NIS2, GDPR, etc.).
Develop and maintain the framework of security policies, standards and procedures (remote access, communications, backups, use of accounts, etc.), ensuring their implementation in all countries and assets of the company, according to size and type.
Carry out periodic cybersecurity risk assessments in OT infrastructures and control systems (SCADA, PLC, RTU, plant networks), identifying vulnerabilities and prioritizing mitigation actions.
Develop and follow risk management plans, including technical and organizational measures.
Prioritize and track remediation plans from OT risk assessments and audits, including deadlines, owners, and completion indicators.3.
OT Security Architecture and OperationsDesign and validate OT network security architecture, including network segmentation, secure remote access systems, traffic monitoring, and IT/OT segregation.
Align OT architectures and solutions avoiding silos and promoting shared security capabilities.
Define security requirements for new plant projects, SCADA upgrades or communications, reviewing third-party designs and ensuring that deliverables meet defined cybersecurity standards.
Lead remediation campaigns (patching, hardening, segmentation) in coordination with IT, OT, O&M and vendors, ensuring no operational regression.
Participate directly in configuration reviews (firewalls, VPN, remote access, accounts), OT backup restoration tests, and business continuity exercises.4.
Monitoring, detection and response to incidentsEstablish and coordinate security monitoring capabilities applied to critical OT networks, defining use cases, alarms, and escalation procedures.
Lead cybersecurity incident response, from detection to shutdown (containment, eradication, recovery, and lessons learned), including coordination with IT, Insurance, Legal, and Corporate Communication when necessary.
Establish structured post-incident processes (Root Cause Analysis, action plans, tracking to closure) integrated into risk/security committees.5.
Regulatory compliance, audits and reportingEnsure compliance with the regulations applicable to critical infrastructure security, data protection and industrial cybersecurity in the countries where the company operates, coordinating internal and external audits.
Prepare periodic cybersecurity status reports (KPIs), main incidents, level of maturity and progress of action plans for Management, Risk Committees and others.6.
Third-party management and supplier lifecycleDefine and review cybersecurity clauses in contracts, RFPs, and SLAs with OT, communications, cloud, and O&M service providers, including hardening, support, patching, and incident management requirements.
Assess and monitor the cybersecurity risk of critical third parties (SCADA integrators, communications providers, SOC services) and coordinate corrective actions when breaches or breaches are identified.7.
Awareness, training and safety cultureDesign and execute cybersecurity training and awareness programs, adapted to OT (plant operators, field technicians, O&M) and IT groups, promoting good practices in the use of credentials, remote access and mobile devices.8.
Remote access and communications managementDesign, implement and supervise the secure architecture of communications between plant assets (SCADA, PLC, inverters, trackers) and control centers, guaranteeing the integrity, confidentiality and availability of operational data at all times.
Establish and maintain secure VPN tunnels (IPSec, OpenVPN) and