Railway & OT Cybersecurity Architect

Job description

Purpose of the position The Project Cybersecurity Architect is responsible for defining, maintaining and governing cybersecurity architectures for railway and infrastructure projects in Israel. The initial assignment will support the Haifa-Nazareth Nofit Light Rail Project. The position may subsequently support other projects according to business priorities and workload. The role translates contractual, operational, safety and technical requirements into secure and resilient architectures, cybersecurity requirements and risk-treatment measures. Organisation structure Alstom Transport Israel Digital and Integrated Systems Israel Cybersecurity Organisation Reports directly to Israel Cluster Cybersecurity Manager Location and mobility Primary location: Holon, Israel Regular travel to project sites, customer premises and supplier locations may be required Initial assignment: Haifa-Nazareth Nofit Light Rail Project Main responsibilities Define, maintain and govern project cybersecurity architectures throughout the system lifecycle. Perform cybersecurity risk assessments, threat modelling and attack-path analysis. Define security zones, conduits, trust boundaries and defence-in-depth principles for IT, OT and railway environments. Translate contractual, regulatory and risk-driven needs into clear and verifiable cybersecurity requirements. Allocate cybersecurity requirements to systems, subsystems, products, interfaces and suppliers. Maintain traceability between cybersecurity risks, security objectives, architecture controls, requirements and verification evidence. Review system and subsystem architectures, network designs, interfaces and data flows for cybersecurity compliance and consistency. Assess network segmentation, firewall policy, remote access, identity and privileged access, PKI, monitoring, hardening, backup and vulnerability-management solutions. Prepare and maintain cybersecurity architecture descriptions, risk assessments, detailed-design documents, zoning diagrams and technical review records. Lead cybersecurity technical reviews and support project design and lifecycle gate reviews. Review supplier and subcontractor cybersecurity architectures, technical evidence and compliance documentation. Define compensating controls where remediation is constrained by legacy technology, safety, certification, vendor dependency or operational availability. Support cybersecurity verification, factory acceptance testing, system integration testing, site testing, commissioning and transition to operation. Assess the cybersecurity impact of vulnerabilities, technical changes, deviations and nonconformities. Provide technical guidance to project teams, system architects, engineers, suppliers and other stakeholders. Escalate unresolved architecture risks and deviations through the applicable project and cybersecurity governance. Contribute to reusable cybersecurity architecture patterns, peer reviews, lessons learned and continuous improvement across projects in Israel. Authority and performance measures Act as the technical reference for cybersecurity architecture within the assigned project scope. Request relevant technical evidence, design clarification and corrective-action proposals. Recommend acceptance, conditional acceptance, rejection or escalation of cybersecurity design decisions. Deliver cybersecurity architecture outputs according to agreed quality and schedule commitments. Ensure timely closure or escalation of architecture-review comments, technical findings and design nonconformities. The employee shall promote the Alstom Code of Ethics and maintain high standards of professional conduct, integrity and confidentiality. Main required competences Educational requirements Bachelor's or master's degree in cybersecurity, computer science, software engineering, systems engineering, electrical engineering, communications engineering or a comparable technical discipline. Mandatory professional experience Significant professional experience in cybersecurity architecture, systems architecture, network security architecture or secure system design. Experience performing cybersecurity risk assessments and translating their results into architecture controls and technical requirements. Experience reviewing complex system and subsystem architectures, interfaces, network flows and security controls. Experience working with multidisciplinary engineering, project-management and supplier teams. Experience producing controlled technical documentation and presenting technical decisions to stakeholders. Technical skills Cybersecurity architecture and secure-by-design principles. IT and OT network architecture, segmentation, zoning and secure conduits. Cybersecurity risk assessment, threat modelling and risk-treatment methods. Identity and access management, privileged access and secure remote access. Firewalls, IDS/IPS, network access control and security gateways. PKI, certificate lifecycle management, encryption and key management. Security logging, monitoring, detection and SIEM integration. System hardening, secure configuration and vulnerability management. Backup, recovery, resilience and business-continuity principles. Requirements engineering, traceability and technical verification. Supplier and third-party cybersecurity assurance. Standards and frameworks ISA/IEC 62443 CLC/TS 50701 or the applicable railway cybersecurity reference ISO/IEC 27001 and ISO/IEC 27005 NIST Cybersecurity Framework and relevant industrial-control-system guidance Desirable experience Experience in railway, transportation, operational technology, industrial control systems or other critical-infrastructure environments. Experience with long-lifecycle, safety-related or high-availability systems. Experience supporting detailed design, integration, testing, commissioning or customer design reviews. Experience working in multi-company or public-infrastructure projects. Behavioural competencies Strong systems thinking, analytical and problem-solving capabilities. Pragmatic and risk-based technical decision-making. Ability to work autonomously while remaining aligned with project governance. Ability to challenge technical designs constructively and influence stakeholders. Strong written and verbal communication skills. Ability to work effectively in a multicultural and multidisciplinary environment. High standards of professional ethics, accountability and confidentiality. Languages Professional proficiency in written and spoken English. Hebrew is an advantage. Desirable certifications CISSP, ISSAP, CISM, GICSP, SABSA, TOGAF, ISA/IEC 62443 certification or equivalent.