Senior SOC Engineer – OT Security

About the role

We are looking for an experienced Senior SOC Engineer to lead advanced security monitoring, threat detection, incident response, and threat hunting across Operational Technology (OT) and Industrial Control System (ICS) environments. The role is critical for strengthening OT cyber resilience while maintaining high‑availability, mission‑critical industrial operations.

Key responsibilities

• Administer, manage, and tune OT security monitoring tools such as Nozomi and Forescout.
• Monitor OT/ICS environments using SIEM and specialized OT platforms, detecting and responding to cyber threats.
• Maintain OT asset visibility, establish network behavior baselines, and support micro‑segmentation aligned with the Purdue Model.
• Collaborate with OT engineering teams to safely implement containment actions and handle incidents with minimal disruption.
• Develop and tune OT‑specific detection rules, aligning use cases with the MITRE ATT&CK for ICS framework.
• Operate packet brokers, TAPs, and SPAN infrastructure to provide deep packet inspection of industrial protocols (Modbus, DNP3, OPC‑UA, IEC 104, Ethernet/IP).
• Maintain accurate OT asset inventories, conduct proactive threat hunting, and ensure compliance with relevant standards.

Required profile

• Proven experience in OT/ICS security monitoring, incident response, and threat hunting.
• Strong understanding of industrial network architectures and the Purdue Model.
• Ability to work closely with OT engineering teams and manage security actions in live industrial environments.

Required skills

• Nozomi, Forescout
• SIEM platforms
• MITRE ATT&CK for ICS
• Industrial firewalls, IDS/IPS, NAC
• Packet brokers, network TAPs, SPAN
• Industrial protocols: Modbus, DNP3, OPC‑UA, IEC 104, Ethernet/IP
• Micro‑segmentation, network telemetry, asset inventory tools