Operational Technology (OT) Incident Response Consultant

What You Will Do

• Incident Response & Threat Investigation
• Investigate and response of high-severity OT security incidents.
• Perform root cause analysis to determine threat origin, attack scope, and affected assets.
• Conduct threat analysis across industrial environments.
• Analyze network traffic, system logs, and security events to identify malicious activity and attack patterns.
• Research emerging threat actors, attack campaigns, and OT-specific tactics, techniques, and procedures (TTPs).
• • Detection Engineering & Security Monitoring
  • Develop and enhance OT-specific detection use cases and threat detection procedures.
  • Tune and optimize alerts generated by OT security controls to improve detection accuracy and reduce noise.
  • Correlate information from security platforms, threat intelligence feeds, network telemetry, and other data sources.
  • Support the implementation and continuous improvement of SIEM monitoring strategies, escalation workflows, and alerting mechanisms.
  • • OT Security Consulting & Advisory
    • Serve as a Subject Matter Expert (SME) during OT cybersecurity incidents and security engagements.
    • Provide technical recommendations for remediation, mitigation, and risk reduction.
    • Support customers in strengthening their OT cyber security programs, processes, and operational procedures.
    • Assist with the design and implementation of proactive OT security controls and monitoring capabilities.
    • Contribute to the development of new security capabilities, tools, and automation initiatives.
    • Stay current with OT security trends, vulnerabilities, defensive technologies, and industry best practices.

What You Will Bring

Technical Experience

• Experience working in cybersecurity, incident response, security operations or threat detection environments.
• Desirable to have a minimum 2 years of experience supporting industrial control systems such as PLCs, RTUs, DCS, SIS, SCADA, HMI, MES, or Historians.
• Understanding of OT and ICS architectures and operational environments.
• Experience investigating security incidents and performing root cause analysis.
• Hands-on experience with SIEM technologies, event monitoring, detection use cases, alert tuning, escalation workflows, and threat intelligence.
• Experience analyzing firewall logs, IDS/IPS events, system logs, network telemetry, and security events.
• Solid understanding of network protocols including TCP/IP and UDP.
• Familiarity with industrial communication protocols such as Modbus, DNP3 and other specific ICS protocols.
• Understanding of the Purdue Enterprise Reference Architecture model.
• Ability to conduct network traffic analysis and identify indicators of compromise in OT environments.
• Understanding of cyber threat actor tactics, techniques, and procedures (TTPs).
• Experience with vulnerability analysis, threat research, and security investigations.
• Ability to communicate in English.
• Willingness to participate in shift work including nights, weekends and holidays (our MDR service is 24x7x365).