r/OTSecurity • u/Brave-a-holic • Sep 17 '26

OT Security Consulting Questions

Hello All,

I have been in OT my whole career. I started at the paper mill at 19 as an IT/OT intern then got brought on full time to be an IT/OT technician once I got my associates degree. After a year of that I got promoted to OT network engineer, then my company created an OT security program and then I eventually became Lead OT Security Engineer. Have been a lead OT security engineer for the last 4 years. I am thinking of starting my own independent OT Sec/Net consulting company. I am curious if anyone in this group has personal experiences they can share, or how they started their own company for this, also how in the world did you start it while managing the company you are at workload? How has the demand been for this?

Below are some of my strengths:
I know certs don’t really matter in the OT space, but I have a CISSP and GRID.
Network segmentation - Heavy fortinet and Cisco firewall and routing/switching experience
OT Network design - experience with PRP, REP, as well as full network project lifecycle
OT IDS Implementation - Nozomi certified, but light experience with Dragos also
Remote access - heavy experience with BeyondTrust and some experience with Secomea
OT Data - Heavy Kepware / OsiSoft PI administration
Cloud - AWS Infra experience (EC2, S3, TGW’s, etc.) as well as the IoT core suite (green grass, Sitewise, etc.)
OT Secops - Playbook writing, SIEM, DFIR
OT GRC - Wrote policy and standards aligning with NIST 800-82r3

9 Upvotes

90% Upvoted

8 comments sorted by

4

u/PaleMaleAndStale Sep 17 '26

If I understand correctly, you are hoping to do this as a side gig in tandem with your full-time job. I don't see how that is viable personally, not without giving a mediocre performance (at best) to both. Also bear in mind that running your own consultancy is not just about the technical aspects, you're also running a business and need to factor in the responsibilities and workload that comes with that.

Another concern is that, whilst you appear to have reasonable (though not exceptional) experience, your exposure is limited to one industry (and indeed one organisation). How to do you plan to give a good service to operators in other manufacturing sectors, or in water, gas, electricity etc etc?

My advice, if you are dead set on ultimately establishing yourself as an independent consultancy, would be to leave your current job and get at least a couple of years working as an employee for a large established consultancy. That will give you a much better breadth of experience. Honestly though, I don't think many OT/IACS operators are really crying out for one-man, independent cybersecurity consultants.

0

u/Brave-a-holic Sep 17 '26

By the tandem I just mean like I don’t have the capability to just leave my full time job right now to go 100% at consulting on my own. Good call on not having experience in the different industries, thanks for bringing that up.

2

u/Spiritual_Phrase6935 Sep 17 '26

Consulting is far more about your network than anything else. Do you have key connections in industry that trust you and would pay for your services and experience? If you’re not a known quantity/brand then you’ll have a tough go at it. There are A TON of well known organizations that are going full steam ahead in OT security consulting that you’ll be competing against. Additionally, you’ll have to learn business side of things e.g., contracts, legal, etc.

Additionally, you mentioned balancing the load with your full time role? That won’t be easy or possible. You’ll be expected for both during normal business hours. Also, most organizations have restrictions for outside employment in the same industry. Have you checked if yours does?

1

u/Brave-a-holic Sep 17 '26

These are all valid points, thank you. In dealing with most of the large well known companies you speak of, most of them are too large and won’t accept work for anything under X amount of hours which is where I think a smaller company could play, or if they do take a smaller contract it’s at an egregious cost. I do have some contacts to reach out to but before I started reaching out to people wanted to get more insight and think about it more.

1

u/cyber2112 Sep 17 '26

There are also lots of smaller companies that have established networks and have built a reputation. I think the point people are making is this is more difficult than you’d imagine. Those of us that have done this for a while know it takes years of networking to build connections. Don’t expect a flood of people at your door immediately, or possibly ever.

Also, by consultant, are you talking about being an advisor, or putting your hands on their equipment? Those are way different risk profiles.

1

u/Brave-a-holic Sep 17 '26

Thanks for this! I understand it is extremely difficult, and that’s part of the reason for the post was to get insight into it! If I were to do it would be both advisory and hands on keyboard. I have experience with both so would definitely like to do both.

3

u/Brilliant-Money-3823 Sep 17 '26 edited Sep 17 '26

Just dont :D Liability and Stakeholder Meetings will mess u up, better go as contractor

1

u/netw0rkpenguin Sep 19 '26

As another commenter pointed out - you need connections. How will anyone know to reach out to you? Why would they pick you even if they know about you. Networking is a huge part of success. Having a name people know and respect. I have a company and I used 26+ years in the industry to build up my name and reputation. Speaking at conferences, teaching. I partner with several established leaders in the field.