OT Cyber Analyst

Basic Function

HF Sinclair is seeking for a OT Cyber Analyst in the following locations Dallas,TX, Arestia,NM, El Dorado, KS ,Tulsa,OK, Casper,WY, Sinclair, WY, Salt Lake City, UT, Woods Cross, or Anacortes, WA .The OT Cybersecurity Analyst serves as a fleet-wide Operational Technology (OT) cybersecurity specialist responsible for strengthening the security, visibility, and resilience of Industrial Automation and Control Systems (IACS) across HF Sinclair sites. The position applies specialized depth and breadth of OT cybersecurity expertise to independently interpret security telemetry, threat and vulnerability information, control gaps, and operational risk; recommend and drive improvements to monitoring, incident response, vulnerability management, asset visibility, secure access, and ISA/IEC 62443-aligned practices; and provide expert guidance to site and enterprise stakeholders. The role leads complex cross-functional cybersecurity workstreams and projects of moderate risk, resource requirements, and complexity, exercises independent judgment within established governance, and drives measurable fleet-wide risk reduction and continuous improvement in coordination with the OT Infrastructure & Cybersecurity Lead, OT System & Infrastructure Specialist, regional support teams, site OT teams, IT, vendors, and business stakeholders. Job Duties

Own and oversee OT cybersecurity monitoring and telemetry health across fleet environments, including SIEM, Syslog, endpoint protection, security dashboards, and approved monitoring platforms. Serve as the primary liaison with the 24/7 SOC team to review, investigate, correlate, and escalate OT cybersecurity alerts, suspicious activity, authentication anomalies, remote access events, and policy violations. Lead and support OT cybersecurity incident response activities, including investigations, root cause analysis, risk assessments, containment planning, recovery efforts, and corrective actions. Develop, maintain, and enhance OT security monitoring use cases, alerting, dashboards, reporting, detection logic, and escalation procedures. Identify and resolve gaps in OT asset visibility, monitoring coverage, vulnerability management, and asset inventory systems to improve fleet-wide security posture. Lead vulnerability management efforts by reviewing findings, assessing operational risk, prioritizing remediation activities, tracking corrective actions, and reporting results. Analyze threat intelligence, security advisories, patches, and vendor notifications to assess operational impact and recommend appropriate mitigation strategies. Develop and report cybersecurity metrics related to monitoring coverage, endpoint protection, vulnerability management, asset inventory, and overall fleet visibility. Support cybersecurity audits, compliance initiatives, risk assessments, and regulatory readiness activities by validating controls, reviewing evidence, and driving corrective actions. Serve as a subject matter expert on OT cybersecurity best practices, including asset visibility, security monitoring, incident response, vulnerability management, and risk management. Evaluate vendor risk, third-party connectivity, and secure remote access practices, recommending risk-based controls and improvements. Maintain governance of OT asset inventories, network documentation, system records, and cybersecurity documentation to ensure accuracy and enterprise visibility. Partner with OT, operations, maintenance, IT, cybersecurity, and vendor stakeholders to improve cybersecurity controls, monitoring effectiveness, and asset visibility across fleet locations. Lead cybersecurity projects and workstreams, coordinating stakeholders, managing risks, and delivering operational and cybersecurity objectives. Provide technical guidance, mentoring, and cybersecurity expertise to site and enterprise teams while translating emerging threats and vulnerabilities into actionable