Hiring OT security talent is hard enough when everything goes right. The candidate pool is small because the bar for what good looks like is so high, and that’s why the people in it know what they’re worth.
That’s why avoidable mistakes hurt so much. Here are the five we see most often, and how to fix each one.
Mistake 1: Writing junior briefs with senior requirements
This is the one we see most. A hiring manager wants someone who can hit the ground running, so the junior brief slowly fills up with everything the team is missing.
You end up with an entry-level analyst role asking for IEC 62443, PLC programming, incident response and five years on industrial sites. That person exists. But they’re a senior engineer, and they expect a senior salary.
With the OT security talent shortage in the UK, very few people have deep experience across several domains, and the ones who do are already senior. It isn’t unique to OT. In ISC2’s 2025 Cybersecurity Hiring Trends Report, more than a third of hiring managers wanted advanced certifications such as CISSP from entry- and junior-level hires.
Split the brief into what someone needs on day one and what you can teach them in their first year. Not only will you widen the pool, but the person you hire will now have room to grow.
Mistake 2: Treating OT security like IT security
Hiring managers and OT specialists rarely make this one themselves, but it happens around them. When HR teams or generalist recruiters write the job ad and screen, they assume the experience transfers straight across between the two disciplines.
OT security protects physical processes, so availability and safety come first. A patch an IT team would apply straight away may have to wait for a planned shutdown. A scan that’s routine on a corporate network can knock over a legacy controller. Screen for general “cybersecurity experience” and your hiring manager gets a pile of strong IT profiles that miss all of this.
People from IT can make excellent OT hires, and we actively source from that pool. Whoever screens them just needs to know what to test for and what the transition fully entails.
Mistake 3: Running a slow interview process
Slow processes lose candidates in every sector, and a tight candidate pool compounds the issue. NIS2 and standards like IEC 62443 have pushed critical infrastructure operators to build OT teams, so strong OT security candidates rarely run one process at a time. Stretch yours to five stages over a couple of months, and they might end up taking the offer that arrives first.
Agree the stages and decision makers before the role goes live, and give feedback within 48 hours. Once you’ve found the right person, a verbal offer that week beats a perfect written one a fortnight later.
Mistake 4: Screening on certifications instead of hands-on ICS experience
OT security certifications such as GICSP and IEC 62443 are worth having. The trouble starts when they become a hard filter. The SANS 2024 State of ICS/OT Cybersecurity survey found that only 49% of respondents held or had held an ICS/OT-specific credential. Filter on certificates alone, and you lose half the market before you’ve looked at what anyone has done.
Hands-on ICS experience often tells you more. Look for time spent with PLCs and SCADA systems on live sites, and a feel for how those systems behave when something breaks.
Consultancies lean on certifications the hardest. Their clients want that confidence, and some contracts require it. But that habit causes problems when it spreads to in-house roles. If you find someone with years of practical ICS experience and no certificate, hire them and pay for it. That costs far less than a role sitting empty for months.
Mistake 5: Hiring OT security through non-specialist channels
This mistake does the most damage. In larger organisations, OT security roles often go through HR or procurement first, then out to a preferred supplier list of generalist agencies. All this sometimes happens in a vacuum detached from real market conditions.
Vetting is where it falls apart. If the people screening can’t judge the technical side, they match keywords, and keywords mislead in OT. “Security engineer” means very different jobs at different companies. SCADA on a CV might mean years on site, or one slide deck.
Good vetting means asking questions only someone with site experience can answer well:
- How did they make a change on a system that couldn’t go offline?
- How do they work with control engineers who see security as a threat to uptime?
A recruiter needs enough OT knowledge to tell whether the answers hold up. Without it, your hiring manager becomes the filter and loses hours to interviews that go nowhere.
It’s why we keep shortlists tight. As exclusive supplier to a global MSSP hiring for an FMCG client, we put forward no more than three candidates per role, from coordinator up to business unit CISO. Our expertise is how we save them time without compromising on quality.
OT security is a small, specialist market, and it rewards companies that hire like specialists. Pitch the brief at the right level and keep things moving. Judge people on what they’ve done on site, and put someone with real OT knowledge between your hiring manager and the market. That last part is what OT security recruitment should give you.
Frequently Asked Questions
What are the most common mistakes when hiring OT security professionals?
The five we see most are inflated junior briefs, treating OT like IT hiring, slow processes, screening on OT security certifications over hands-on ICS experience, and sending the search through non-specialists. Most of them happen before the first interview.
How long should an OT security hiring process take?
Keep it as short as you can while still testing what matters. Agree the stages upfront and give feedback within 48 hours. Strong OT security candidates rarely stay on the market long.
Do OT security candidates need GICSP or IEC 62443?
OT security certifications matter most in client-facing consultancy roles. For in-house teams, hands-on ICS experience is usually the better signal, and you can fund the certification after someone joins.
Why use a specialist OT security recruitment agency?
A specialist can assess the technical experience that generalists can’t, so your hiring manager only meets people worth interviewing. They also know where OT talent sits, including IT security professionals ready to move across.
Ready to talk?
At Paradigm Tech, OT security is all we do.
We specialise in connecting high-performing, well-qualified candidates with the systems that need them most, and we’d love to help you! Whether you’re a candidate or looking for top candidates, get in touch:
About the author
Ben Griffiths is one of the founders of Paradigm Tech. As a specialist in IT and cyber security, he understands the nuance of placing the right people in organisations where IT and OT converge. Together with his partner, Charlie, they started Paradigm Tech to only focus on OT recruitment. This singular focus enables them to build a narrow but deep network of candidates with the correct certifications and hands-on experience. Connect with Ben on LinkedIn.
