There is perhaps no more acutely contested talent market in Cyber Security right now than OT/ICS Security. Demand has reached a level where clients routinely describe searches as the hardest they've ever attempted — and where specialists with genuine operational technology depth command compensation that would have seemed extraordinary five years ago.
Understanding why requires understanding what OT/ICS security actually is — and why it's so hard to find people who do it well.
The Convergence Problem
Operational technology security sits at the intersection of two worlds that have historically operated in silos: the IT security world, which most cyber professionals know well, and the OT/ICS world, which is the province of industrial engineers, process control specialists, and plant operators.
Effective OT/ICS security requires deep fluency in both. A professional who understands TCP/IP but has never worked with SCADA systems, PLCs, or distributed control systems won't be effective in a critical national infrastructure environment. Equally, an industrial engineer with no cyber security background won't be able to design and implement the protective architecture these environments need.
The overlap between these two populations is genuinely small.
What Commands the Premium Salary
The professionals who command £100,000+ in this space typically bring some combination of the following:
- Hands-on experience with industrial control systems — ideally in energy, water, manufacturing, or transport
- Deep knowledge of OT-specific protocols: Modbus, DNP3, IEC 61850, Profinet
- Threat modelling capability in OT environments
- Incident response experience in operational settings
- A working understanding of frameworks like IEC 62443 and NIST SP 800-82
Professionals with all of these elements are extraordinarily rare. Those with two or three are still in very short supply. And as critical national infrastructure operators face increasingly stringent regulatory requirements, demand is accelerating.
How to Attract Passive OT/ICS Talent
Most of the best OT/ICS security professionals are not actively job hunting. They're embedded in long-term relationships with employers who value them, often in regulated environments where job security is high and the mission is genuinely meaningful.
To attract them, you need three things: a compelling reason to move (mission, growth, compensation), a recruiter who can reach them through professional networks rather than job boards, and a hiring process that respects their expertise and moves at pace.
At Envo Talent, our Cyber Security practice has built specific depth in OT/ICS talent. If you're hiring in this space, get in touch or book a discovery call.