Part-Time Operational Technology (OT) Penetration Tester

LOCATION/SCHEDULE: Hybrid or onsite as required supporting Nassau County, NY. Majority of work will be performed during standard business hours Monday-Friday, 8:00 AM-5:00 PM EST, with occasional nights, weekends, or approved maintenance-window support during OT/ICS discovery, rules-of-engagement coordination, testing execution, validation, reporting, and stakeholder briefings. (Anticipated 400 hours per contract year.)

KEY RESPONSIBILITIES: Perform hands-on internal and external penetration testing, web application security testing, wireless assessment, firewall review, vulnerability validation, segmentation analysis, and controlled exploit testing across approved enterprise, government, and operational environments. Perform passive and active discovery, architecture review, segmentation analysis, firewall and access-control review, vulnerability validation, and controlled exploit testing where explicitly authorized. Support approximately 900 hours of annual senior penetration testing activities for County IT, District Attorney, Police Department, web application, wireless, firewall, infrastructure, and enterprise security validation activities. Support approximately 400 hours of annual OT penetration testing activities for OT, ICS, SCADA, critical infrastructure, public-safety, segmented OT, and OT-adjacent assessment activities, including radio communications, CAD-related infrastructure, evidence systems, specialized operational networks, and related environments where applicable. Coordinate closely with government client IT, legal or investigative stakeholders, public-safety representatives, authorized liaisons, system owners, and operational stakeholders to minimize disruption and protect mission-critical operations. Use OT-safe testing methods that emphasize passive validation, configuration review, protocol-aware assessment, and controlled testing rather than disruptive scanning or exploitation. Use automated penetration testing and attack-path validation tools, including Horizon3.ai where applicable, in coordination with approved rules of engagement, testing windows, credential handling requirements, and safety constraints. Analyze findings using risk-based methods aligned to NIST CSF, NIST SP 800-53, NIST SP 800-82, NIST SP 800-115, CIS Controls, CVE/CVSS, and applicable CJIS considerations. Develop detailed technical findings, evidence, attack-path narratives, operational impact analysis, prioritized remediation recommendations, and executive-ready summaries. Support annual penetration testing, operational security validation, wireless assessment, firewall review, infrastructure hardening review, and modernization roadmap activities involving OT or OT-adjacent environments. Participate in client briefings, remediation planning, retesting, lessons learned, and knowledge transfer activities to support long-term operational resilience.

REQUIRED QUALIFICATIONS: Bachelor's degree in Cybersecurity, Information Technology, Engineering, Computer Science, Industrial Control Systems, or related field, or equivalent professional experience.5+ years of cybersecurity assessment, penetration testing, vulnerability assessment, network security, security engineering, or OT security experience, including senior-level enterprise penetration testing experience and hands-on OT/ICS or critical infrastructure security experience. Hands-on experience assessing OT/ICS, SCADA, industrial networks, critical infrastructure, public-safety systems, segmented environments, or mission-critical operational networks. Strong understanding of OT network architecture, industrial protocols, segmentation models, engineering workstations, HMIs, PLCs, RTUs, historian systems, remote access controls, and operational safety considerations. Experience with penetration testing methodologies, vulnerability validation, attack-path analysis, firewall and network-device review, wireless assessment, automated penetration testing tools including Horizon3.ai, OT penetration testing tools, and secure reporting practices. Ability to conduct testing in production or sensitive environments using disciplined coordination, change control, safety planning, and non-disruptive assessment techniques. Strong written communication, technical reporting, stakeholder coordination, and executive briefing skills.

PREFERRED QUALIFICATIONS: Experience supporting cybersecurity assessments for utilities, transportation agencies, defense organizations, law enforcement, emergency services, municipal environments, or other critical infrastructure operators. Familiarity with NIST SP 800-82, NERC CIP concepts, CJIS security requirements, IEC 62443 principles, MITRE ATT&CK for ICS, OWASP, PTES, and OSSTMM-aligned testing practices. Experience with tools such as Horizon3.ai, Tenable/Nessus, Nmap, Wireshark, Burp Suite, Metasploit, Kali Linux, OT penetration testing tools, OT protocol analyzers, firewall review tools, and safe discovery or configuration-review utilities. Relevant certifications such as GICSP, GRID, GCIP, GPEN, CISSP, CISM, CRISC, CEH, PenTest+, Security+, Network+, CCNA, or equivalent OT/cybersecurity credentials. Experience preparing executive and technical reports that include operational impacts, compensating controls, remediation sequencing, and retesting criteria. IMRI offers top-tier benefits that include: medical coverage through nationally recognized carriers, ancillary coverages, paid vacation and sick leave in compliance with all state and local laws, 401(k) with company match, company paid life insurance and LTD, and several additional voluntary coverages. Pay will be commensurate with the experience, skills, and qualifications that the candidate brings to the position.

Equal Employment Opportunity Statement: IMRI is an Equal Employment Opportunity employer. IMRI prohibits unlawful discrimination and harassment and provides equal employment opportunity to all applicants and employees consistent with applicable federal, state, and local laws. Employment decisions are based on qualifications, merit, business needs, and other lawful job-related factors without regard to race, color, religion, sex, national origin, age, disability, protected veteran status, genetic information, or any other characteristic protected by law. As a federal contractor, IMRI complies with Section 503 of the Rehabilitation Act and VEVRAA and takes affirmative action with respect to qualified individuals with disabilities and protected veterans as required by law.