Why pre-screen industrial control systems specialists before the site interview
The instincts that work on corporate networks are dangerous here. Patch on discovery, scan the network, enforce multi-factor authentication everywhere: each of those can stop a process, and stopping some processes causes damage or injury. Specialists worth hiring know which controls are appropriate, what compensating measures look like, and why a twenty-year-old controller cannot simply be replaced. A short screen asks what they would decline to patch and why.
What actually matters when screening Industrial Control Systems Specialist candidates
- 01
Technical depth
Check depth on PLC and DCS platforms they name: Rockwell ControlLogix, Siemens TIA Portal, DeltaV. Ask about IEC 61131-3 languages, HMI tag architecture, Modbus TCP and Profinet addressing.
- 02
Work that shipped
Probe commissioned systems: loop checks, FAT and SAT sign-off, batch or motor control migrations, downtime windows they worked inside, and measured throughput or uptime gains after cutover.
- 03
Diagnosis under uncertainty
Test how they chased intermittent faults: nuisance trips, comms dropouts on a redundant ring, drifting analogue inputs. Ask what they trapped with historian trends or Wireshark captures.
- 04
Working across the org
Assess work with operations, maintenance, and OT security: change control under MOC, handover documentation, operator training, and negotiating patching or network segmentation with IT.
Pre-screening questions to ask Industrial Control Systems Specialist candidates
12 questions grouped by what they test. Ask the same set in every screen and score answers on a consistent scale, or send them as an async video screen and compare answers side by side.
Systems they ran
3 questions01What types of industrial control systems are you most familiar with?
Listen forNamed platforms and vendors with the industries they were deployed in, and what they did with them personally.
Systems named with no hands-on work, or familiarity limited to reading about the technology.
02Can you describe your experience with supervisory control and data acquisition platforms?
Listen forPractical work including tag configuration, alarm management and historian use rather than viewing screens.
Experience limited to operator screens, or alarm floods treated as normal rather than a design problem.
03Do you have experience with programmable logic controllers?
Listen forLogic they can read and reason about, with a clear position on what they would change on a running plant.
Logic changed without a change process, or no ability to read the programs on the systems they support.
Why operational differs
4 questions04What is your understanding of the cybersecurity risks specific to control systems?
Listen forAvailability and safety placed above confidentiality, with an explanation of why standard practice can be harmful.
Corporate security practice applied unchanged, or no recognition that a stopped process can cause damage.
05How have you helped implement and maintain security measures in control environments?
Listen forSegmentation and monitoring favoured over intrusive controls, with compensating measures where patching is impossible.
Agents installed on control systems without vendor approval, or patching applied without a shutdown window.
06Have you conducted vulnerability assessments for control systems? What did that involve?
Listen forPassive assessment on live systems, with active scanning restricted to test environments or outage windows.
Active scanning on a running plant network, or no awareness that scanning can crash older devices.
07What policies and procedures do you use to ensure system security?
Listen forChange control and access management adapted for operational realities, including vendor remote access.
Vendor remote access left permanently open, or policies copied from corporate with no adaptation.
Root cause while running
2 questions08Could you describe a time when you had to troubleshoot a control system issue?
Listen forDiagnosis from process data and historian records first, with intrusive testing avoided while the plant runs.
Testing performed on the live system as a first step, or components replaced with no diagnosis.
09What process do you use to determine the root cause of a control system malfunction?
Listen forA structured method that considers instrumentation, logic, network and process together rather than in isolation.
Faults attributed to the most recent change, or investigations closed when the symptom stops.
Upgrades staged safely
3 questions10What strategies have you used for upgrading or replacing outdated control systems?
Listen forPhased migration with a rollback path and validation at each stage, planned around production windows.
Replacements attempted in a single cutover, or upgrades planned with no fallback if commissioning fails.
11Do you have experience working with third-party vendors and system integrators?
Listen forVendor work supervised rather than accepted, including access controlled and changes verified afterwards.
Vendor changes accepted without review, or integrator access granted with no supervision or logging.
12How would you explain the purpose of a control system to someone without a technical background?
Listen forA plain explanation that conveys why availability matters, useful for getting non-technical approval for work.
Explanations that stay technical, or an inability to make the safety case to a manager.
How to score responses
Score every candidate on the same four criteria immediately after the screen. At this stage you are shortlisting for panel interviews, not making the final call.
Technical depth
35%5Names specific controllers and firmware revisions, explains ladder versus structured text choices, and describes tag naming and alarm rationalisation conventions they enforced.
Work that shipped
30%5Walks through a named plant cutover end to end with FAT punch list, hot cutover sequencing, and quantified downtime or OEE improvement.
Diagnosis under uncertainty
20%5Describes narrowing an intermittent fault using trend data, packet captures, and controlled tests rather than swapping cards until symptoms disappear.
Working across the org
15%5Gives examples of persuading operators to trust a new control strategy and agreeing segmentation or patch windows with IT without stalling production.
Patch on discovery and scan the network are corporate instincts that stop a process here. A one-way video screen asks what they would decline to patch.
Try it on HirevireScreening FAQ
Process basics
How long should a pre-screening round for this role take?
Fifteen minutes across eight to ten questions, answered async. Enough to establish which systems they worked on, test their operational security understanding, and hear one fault they traced to root cause.
Can a corporate security specialist move into this role?
Some can, and it takes deliberate learning. Ask directly what they would do differently on a plant network. A candidate who has thought about it will name availability and safety as the priorities; one who has not will describe standard practice.
Evaluating answers
What is the strongest signal when screening this role?
Something they would not patch. Specialists who have worked on live plant know that some systems cannot be touched without a shutdown window, and describe compensating controls instead. Anyone who patches everything has not been on a plant.
How do I judge their diagnostic approach?
Ask how they find root cause when the plant is running. Real answers work from process data and historian records rather than intrusive testing. Anyone whose first move is to test on the live system is a risk.
Go deeper on this role
Sanat has been hiring since 2012 and watching the recruitment industry change up close ever since, and turned that screening process into Hirevire's video screening platform. LinkedIn
