Cyber SOC OT Security Analyst

Role & responsibilities

Conduct in-depth analysis of security events and incidents within OT environments, leveraging SIEM and OT-specific monitoring tools. Perform root cause analysis and develop incident timelines to support forensics and remediation efforts.Apply standard incident response frameworks (e.g., NIST, MITRE ATT&CK for ICS, Cyber Kill Chain) for threat classification and response.Use threat intelligence platforms and sandbox environments to investigate malware and suspicious artifacts in OT networks.

Preferred candidate profile
• Strong understanding of OT/ICS protocols (Modbus, DNP3, OPC, etc.) and industrial network topologies.
• Hands-on experience with OT cybersecurity tools and platforms (e.g., Nozomi Networks, Claroty, Dragos).

• Familiar with ISA/IEC 62443, NIST SP 800-82, NIST CSF, and ISO 27001 compliance requirements for OT.
• Proficiency in using SIEM systems (e.g., Microsoft Sentinel, Splunk, QRadar) for log correlation and event triage.
• Understanding of firewalls, WAFs, proxies, and network segmentation principles in OT.
• Working knowledge of tools such as THOR Scanner, VMRay, or Recorded Future is a plus.
• Experience in vulnerability management and patch advisory for OT assets with limited patch cycles.