The signing requirements for nodes in the Lightning Network are limited to the ability to sign that transactions that make up the smart contracts of the open channels. So first off, only the money in the channels is "hot", which by its very nature it has to be. It would be wise to not keep more money in a lightning node than is required for the channels. For example, keeping your savings on a lightning node would be foolish.
However, lightning nodes also will also earn fees (although how much is unclear), meaning that profit will be generated as the nodes run. This profit, too, is initially locked up in the channels, but will eventually be settled by means of an on-chain transaction. Nodes will likely have a mechanism to send funds from the closing of a channel to a more secure wallet for safe keeping. Either that, or they will take those funds, and use them to fund new channels.
What can a Lightning Network node operator do to secure their nodes hot wallet and protect their private keys?
There is nothing special that lightning nodes will have to do. All the advice is basic information security practices. Don't open ports on your node that you don't have to. Use a strong password to access your node. Disable remote logins if you have physical access. Keep the software that is running patched and up to date. Decrease your attack surface, and reduce the amount of liability (money) you have on any single node to a reasonable amount.
Remember that you put money into a node so that it can make more money. Making money does not come without risks. Mitigate those risks to an acceptable level.