Security Monitoring & Threat Detection • Administration, management, and Support deployment and tuning of OT security tools (Nozomi, Forescout).

• Monitor OT/ICS environments using SIEM and OT security monitoring platforms

• Detect, analyze, and respond to cyber threats targeting industrial control systems

• Support and ensure micro segmentation strategies for OT network zones (Purdue Model alignment)

• Collaborate with engineering teams to safely implement containment actions in live OT environments

• Conduct threat hunting across industrial environments using network and log data

• Handle and support incident response for OT cyber events with minimal operational disruption

• Maintain OT asset visibility and network behavior baselines

• Ensure compliance with IEC 62443, NIST ICS, and organizational security standards

• Work with firewall, IDS/IPS, NAC, and segmentation technologies in OT networks

Detection Engineering & Use Case Management • Develop and tune OT-specific detection rules and correlation logic in SIEM platforms.

• Align detection use cases with MITRE ATT&CK for ICS framework.

• Reduce false positives and improve detection accuracy and coverage.

• Periodically review and optimize alert thresholds and detection logic.

• Support OT security architecture integrating SIEM, IDS/IPS, packet brokers, and segmentation tools.

• Assist in onboarding log sources, parser development, and normalization of OT data.

• Optimize dashboards, alerts, and reporting for operational visibility.

OT Network Visibility, Packet Analysis & Traffic Engineering • Operate packet brokers and TAP infrastructure to enable full OT network visibility.

• Perform deep packet inspection of industrial protocols (Modbus, DNP3, OPC-UA, IEC 104, Ethernet/IP).

• Analyze east-west and north-south traffic for suspicious activity and lateral movement.

• Identify unauthorized communications and protocol anomalies.

• Support network telemetry collection for OT environments.

Asset Visibility, Threat Hunting & Compliance Management • Maintain complete OT asset inventory and network topology visibility.

• Identify unauthorized devices, rogue connections, and shadow OT assets.

• Conduct proactive threat hunting using logs, network telemetry, and behavioral analytics.

• Correlate threat intelligence with OT environment risks and vulnerabilities.

• Ensure compliance with IEC 62443, NIST ICS, ISO standards, and internal security policies.

• Support internal/external audits and provide security evidence for compliance reporting.

• Contribute to risk assessments and OT security posture improvement initiatives.

Reporting & Stakeholder Management • Prepare and present OT security reports (incidents, risks, and trends)

• Maintain dashboards for vulnerabilities, threats, and compliance status

• Communicate critical incidents and risks to SOC, OT, and business stakeholders

• Provide executive-level reporting on OT security posture and exposure

• Track remediation status and SLA Tracking

• Support audit and regulatory reporting requirements (IEC 62443, NIST ICS)

Desired Candidate Profile

Education and Certification Requirements • Bachelor’s degree in Cybersecurity, Information Security, Computer science or related field.

• Certification any one Mandatory:

o GIAC Global Industrial Cyber Security Professional (GICSP)

o ISA/IEC 62443 Cybersecurity Certificate

o GIAC Response and Industrial Defense (GRID)

o ISA Certified Automation Cybersecurity Specialist (IACS)

Job Specific Technical Skills • OT/ICS systems (SCADA, DCS, PLC)

• OT network architecture (Purdue Model, DMZ, segmentation)

• Microsegmentation & Zero Trust for OT

• Packet analysis & Deep Packet Inspection (DPI)

• Packet brokers & TAP/SPAN technologies

• SIEM & OT monitoring tools (Sentinel, Nozomi, Forcescout)

• Incident response in OT environments

• OT threat hunting & anomaly detection

• Threat Detection & Analysis

• Industrial firewalling & remote access security

• OT vulnerability management & asset visibility

• Compliance (IEC 62443, NIST ICS)