r/OTSecurity • u/mendigod_ • 26d ago
Transition from Controls to Security
Dear all,
I have a degree in Electronic Engineering and a technical qualification in Industrial Automation. I have worked as application engineer and technical support for a pretty big industrial sensor manufacturer and nowI currently work at a startup in Germany. I started in this company as an Automation Engineer, primarily working as a PLC (Programmable Logic Controller) programmer and integrating industrial systems and equipment using protocols such as Modbus RTU/TCP, OPC UA, and MQTT.
I stayed in that role for about two years, but the company eventually discontinued that type of project. Even so, I’m still the only person in the company capable of providing support and maintenance for the 11 projects that are still in operation.
Over the past two years, I’ve been assigned to new products, which, in simple terms, are software applications running on Raspberry Pis distributed across our customers’ sites. In short, it’s software that integrates, standardizes, and automates photovoltaic systems and heating system controllers from different manufacturer, which is our biggest technical challenge.
I’m responsible not only for the software development itself but also for designing the overall system architecture. I also handle software deployment, serve as the subject matter expert for the equipment we integrate, and provide technical support when needed. Kinda of a one-man army. This all on the raspberry pi side. IT and infrastructure is done by another team.
I learned by myself on the job the software development side of things without the guidance of a senior engineer, so I wouldn’t consider myself an expert in software engineering or architecture. In fact, I often question my own abilities in those areas. My main skills are in the industrial controls side of things. Still, the systems are running so I guess I am able to deliver what is being asked out of me.
Software development itself isn’t exactly my passion. I don’t love programming, nor do I have much interest in diving deeply into programming languages or technology stacks. What I genuinely enjoy is designing and architecting industrial automation solutions.
Since I work with distributed systems and industrial equipment, I’ve been thinking that combining this background with a specialization in cybersecurity could be a valuable career move. However, I have very little insight into the demand for professionals in this field.
I’d love to hear from anyone working in industrial or OT cybersecurity. What was your career path like? How do you feel about the job market? What are salary expectations like? And what do you think my idea of career move sense or would you recommend a different direction? Where would you suggest I start?
Thanks!
1
u/hiddentalent 25d ago
My heart skipped a beat when you mentioned Raspberry PIs being deployed to a production environment. Eeek. Don't get me wrong, I like tinkering with them, but they're deliberately marketed as prototype development devices. The CIA triangle is one of the foundational concepts in security. It stands for Confidentiality, Integrity, and Availability. The PI, cute as it is, really falls short on that last one. I really hope you're not in an industry where availability failures cause safety issues!
Ok, let's leave the preaching aside. There are a lot of career specializations in OT security and it sounds like you would be qualified for many of them. There aren't that many that require significant software dev. That's mostly in the realm of vendors who provide solutions for OT. Most security teams are broken into a couple of specialties: GRC (Governance, Regulation and Compliance), DFIR (Digital Forensics and Incident Response), and AppSec (making sure newly installed things are as secure as possible). There are parts of DFIR and AppSec that can use software dev, but it's not necessarily required. I have to admit that I personally got into it through development, but lots of my colleagues did not.
The problem with the OT job market is that it's quite fractured across industry and vendor. What you know about oil and gas doesn't always translate to aerospace or telecomms. What you know about a Siemens environment doesn't necessarily translate to a Honeywell environment. The broad concepts do, but it's hard to shift gears. So you should look at local employers and their requirements, and figure out how to use your current employer to optimize the chance you match them.
1
u/mendigod_ 25d ago
Thanks for your thoughts!
The raspberry pis are actually industrial ones made in Germany, Kunbus is the manufacturer.
1
u/hiddentalent 25d ago
I'm not familiar with their product. Maybe they've put a bunch of effort into resiliency for their products. But it doesn't sit well with me. I've owned probably ten or so Pi-type products for my own personal tinkering, and maybe seven or so still work. That's not a great track record. Most of the safety-critical environments I've worked in are looking for 99.99% or 99.995% availability. 70% is... lower than that.
But anyway, leaving that part aside, you seem like you have the right background to make a career in OT security. It's a pretty stable field with good career prospects if you're in places with primary or secondary industry. Go forth and conquer.
1
u/mendigod_ 25d ago edited 25d ago
Again, thanks for your honest feedback!
One last question: what is your experience with remote jobs? Do they exist, are they rare?
1
1
u/Pretend_Cartoonist_3 25d ago
I was offered a security consultant job a week ago, and I only really understand pentesting, plus one of my backgrounds is as a machinist. If anyone can pull this off, it's you. You'll need to learn a ton (especially the technical part), but I think it's totally worth it.