Operational Technology Cyber Analyst

• Own and oversee OT cybersecurity monitoring and telemetry health across fleet environments, including SIEM, Syslog, endpoint protection, security dashboards, and approved monitoring platforms.
• Serve as the primary liaison with the 24/7 SOC team to review, investigate, correlate, and escalate OT cybersecurity alerts, suspicious activity, authentication anomalies, remote access events, and policy violations.
• Lead and support OT cybersecurity incident response activities, including investigations, root cause analysis, risk assessments, containment planning, recovery efforts, and corrective actions.
• Develop, maintain, and enhance OT security monitoring use cases, alerting, dashboards, reporting, detection logic, and escalation procedures.
• Identify and resolve gaps in OT asset visibility, monitoring coverage, vulnerability management, and asset inventory systems to improve fleet-wide security posture.
• Lead vulnerability management efforts by reviewing findings, assessing operational risk, prioritizing remediation activities, tracking corrective actions, and reporting results.
• Analyze threat intelligence, security advisories, patches, and vendor notifications to assess operational impact and recommend appropriate mitigation strategies.
• Develop and report cybersecurity metrics related to monitoring coverage, endpoint protection, vulnerability management, asset inventory, and overall fleet visibility.
• Support cybersecurity audits, compliance initiatives, risk assessments, and regulatory readiness activities by validating controls, reviewing evidence, and driving corrective actions.
• Serve as a subject matter expert on OT cybersecurity best practices, including asset visibility, security monitoring, incident response, vulnerability management, and risk management.
• Evaluate vendor risk, third-party connectivity, and secure remote access practices, recommending risk-based controls and improvements.
• Maintain governance of OT asset inventories, network documentation, system records, and cybersecurity documentation to ensure accuracy and enterprise visibility.
• Partner with OT, operations, maintenance, IT, cybersecurity, and vendor stakeholders to improve cybersecurity controls, monitoring effectiveness, and asset visibility across fleet locations.
• Lead cybersecurity projects and workstreams, coordinating stakeholders, managing risks, and delivering operational and cybersecurity objectives.
• Provide technical guidance, mentoring, and cybersecurity expertise to site and enterprise teams while translating emerging threats and vulnerabilities into actionable improvements.

Special assignments or tasks assigned to the employee by their supervisor, as determined from time to time in their sole and complete discretion.

• At least 5 years of progressively responsible experience in cybersecurity, OT security, IT security operations, systems or network administration, industrial control systems, or equivalent technical disciplines, with demonstrated ownership of complex security activities or programs. 
• Demonstrated specialized knowledge of Operational Technology, Industrial Automation and Control Systems (IACS), distributed control systems, PLC/SCADA environments, industrial networks, and refinery/process control environments, with the ability to assess cybersecurity risk in the context of safety, reliability, and operations. 
• Advanced hands-on experience with security telemetry and operational security tools such as Syslog collection, SIEM, endpoint protection, vulnerability management, asset visibility, dashboards, ticketing, and reporting, including the ability to improve tool coverage, data quality, detections, and operational use. 
• Experience owning or materially improving enterprise or fleet-wide asset inventories, endpoint coverage, logging coverage, configuration records, vulnerability visibility, or cybersecurity monitoring capabilities in OT, industrial, or complex infrastructure environments. 
• Applied knowledge of ISA/IEC 62443 principles, especially asset inventory, zones and conduits, security monitoring, incident response, vulnerability management, risk management, secure access, and secure operation of IACS environments; experience translating framework requirements into practical controls and processes preferred. 
• Demonstrated ability to interpret internal and external cybersecurity challenges, develop risk-based recommendations, and communicate complex technical findings, remediation options, operational impacts, and business risk to technical teams, site leadership, and enterprise stakeholders. 
• Experience leading or coordinating audits, compliance activities, risk assessments, control testing, evidence validation, corrective action programs, or other governance activities across multiple stakeholders or locations preferred. 
• Demonstrated ability to make independent, risk-based decisions within established governance, work calmly under pressure, prioritize competing cybersecurity and operational demands, and escalate material risks appropriately. 
• Proven ability to lead cross-functional teams or projects through influence rather than direct authority, including work with moderate resource requirements, risk, dependencies, and/or complexity. 
• Possesses strong written and verbal communication skills, sound judgment, integrity, accountability, analytical thinking, and a continuous-improvement mindset; demonstrates the ability to provide expert guidance and thought leadership within the OT cybersecurity discipline. 

A minimum of a bachelor’s degree in cybersecurity, computer science, information assurance, management information systems, engineering technology, industrial technology, or related field is preferred. Equivalent cybersecurity, OT, military, technical, or industrial experience may be considered in lieu of degree requirements.

• 5+ years of progressively responsible cybersecurity, security operations, OT support, industrial control systems, or infrastructure experience, including demonstrated ownership of complex cybersecurity work. 
• ISA/IEC 62443 Cybersecurity Fundamentals, Security+, SSCP, GICSP, CySA+, GIAC, Microsoft, endpoint protection, SIEM, vulnerability management, or comparable OT/cybersecurity certifications are a plus. 
• Advanced proficiency with security telemetry and monitoring capabilities for Syslog, SIEM, endpoint protection, vulnerability management, asset visibility, dashboards, metrics, and reporting, including the ability to diagnose coverage gaps and recommend or implement improvements. 
• Strong applied knowledge of OT cybersecurity concepts including alert triage and correlation, log analysis, incident response, vulnerability and patch risk prioritization, secure remote access, third-party risk, asset visibility, ISA/IEC 62443 principles, compliance controls, and compensating safeguards. 
• Ability to independently interpret complex technical and business challenges, exercise expert judgment, and develop risk-based recommendations that improve OT cybersecurity processes, controls, services, and measurable business outcomes. 
• Ability to lead cross-functional cybersecurity projects and functional workstreams with moderate resource requirements, risk, and/or complexity; influence stakeholders, establish priorities, coordinate dependencies, and drive decisions without direct supervisory authority. 
• Ability to serve as a subject matter expert and escalation resource, communicate effectively with technical and non-technical leaders, mentor less-experienced personnel, and promote consistent fleet-wide OT cybersecurity practices. 
• Ability to support fleet-wide sites with up to 40% travel by land or air. 

Leads the work of others as needed and/or acts as team lead or project manager on mid-sized or large projects.

Office based with travel up to 40% of time by land and air is required. Petroleum refinery, warehouse/plant environment, and out-of-doors environment including but not limited to chemicals, pressure vessels, tanks, rotating equipment, fumes or airborne particles, working in confined spaces and exposure to the risk of electrical shock. Subject to all temperatures, weather and varying road conditions.

HF Sinclair offers a comprehensive benefits package designed to support the well-being of our employees and their families. Our benefits include, but are not limited to, the following:

• Medical Insurance
• Vision Insurance
• Dental Insurance
• Paid Time-Off
• 401(k) Retirement Plan with match
• Educational Reimbursement
• Parental Bonding Time
• Employee Discounts

We are committed to fostering a supportive and inclusive work environment, ensuring our employees have the resources needed to thrive professionally and personally. Benefit eligibility is governed by official plan documents, for more details visit Total Rewards.

Job conditions require standing, walking, sitting, twisting, stooping, crouching, kneeling, talking or hearing, making visual inspections, making precise hand and finger movements, reaching or grasping, perceiving color differences, and ability to wear personal protective equipment (beards not permitted).  Job conditions may require lifting or carrying and pushing or pulling up to 50 lbs, and climbing up to 15 ft.  

At HF Sinclair, we are united through our One HF Sinclair Culture, which is underpinned by our five core values of Safety, Integrity, Teamwork, Ownership and Inclusion. Developed to empower our people, our five core cultural values are at the heart of everything we do and extend to how we engage our stakeholders. These values influence our decisions, shape our behaviors and keep us connected across the entire organization. We maintain a true Safety culture for our employees, communities, environments and customers. Our goal is to make sure everyone returns home safely each day. We have a long-standing commitment to Integrity and ethical behavior and do what is right for our employees, investors, communities and the environment. We encourage employees to Step Up and Stand Out by championing a culture of Teamwork and Ownership. We foster a culture of Inclusion by encouraging diversity of experiences, viewpoints and backgrounds. What makes each of us different, together makes us stronger.

HF Sinclair Corporation, headquartered in Dallas, Texas, is an independent energy company that produces and markets high-value light products such as gasoline, diesel fuel, jet fuel, renewable diesel and other specialty products. HF Sinclair owns and operates refineries located in Kansas, Oklahoma, New Mexico, Wyoming, Washington and Utah and markets its refined products principally in the Southwest U.S., the Rocky Mountains extending into the Pacific Northwest and in other neighboring Plains states. HF Sinclair supplies high-quality fuels to more than 1,500 branded stations and licenses the use of the Sinclair brand at more than 300 additional locations throughout the country. In addition, subsidiaries of HF Sinclair produce and market base oils and other specialized lubricants in the U.S., Canada and the Netherlands, and export products to more than 80 countries. Through its subsidiaries, HF Sinclair produces renewable diesel at two of its facilities in Wyoming and also at its facility in Artesia, New Mexico. HF Sinclair provides petroleum product and crude oil transportation, terminalling, storage and throughput services to its refineries and the petroleum industry.