Operational Technology Security Operations Analyst

About the role

Support the security and resilience of operational technology (OT) and industrial control system (ICS) environments. Work closely with Operations, Engineering, IT, the SOC and vendors to ensure security actions do not create safety or production risk.

Key responsibilities

• Monitor and triage alerts from SIEM, passive OT monitoring, firewalls, endpoint tools and other telemetry; validate activity, correlate evidence and document findings.
• Support OT incident assessment, containment and recovery with authorized stakeholders while assessing safety, availability and recoverability impacts.
• Maintain asset, ownership, criticality and monitoring coverage records; identify blind spots and validate sensor, collector and alerting health.
• Review OT vulnerabilities, coordinate safe patching or compensating controls and track actions to closure.
• Check backup and recovery readiness for critical systems and coordinate secure, least‑privileged vendor access.
• Provide cybersecurity input to OT projects and changes, including designs, data flows, zones, conduits and acceptance testing.

Required profile

• Bachelor's degree in cybersecurity, computer science, IT, electrical, instrumentation and control, automation, telecommunications engineering or related discipline.
• At least 5 years of relevant technical experience, including 3 years hands‑on in OT/ICS or industrial environments.
• Practical experience in security monitoring or investigation and familiarity with industrial networking, firewalls, log management, asset visibility, vulnerability handling or incident response.
• Ability to work with operations, engineers and equipment vendors and produce clear technical records and reports.

Required skills

• SIEM and passive OT monitoring tools
• Industrial firewalls and endpoint security tools
• DCS, SCADA, PLCs, HMIs, industrial networks and protocols
• Purdue architecture and ISA/IEC 62443 zones and conduits
• Vulnerability assessment and incident response in OT environments
• Familiarity with NIST SP 800‑82 and MITRE ATT&CK for ICS