Cyber SOC OT Security Analyst

Role Summary

• Position: OT Cyber SOC Analyst L2
  
• Experience: 3–6 years
  
• Location: Bengaluru
  
• Shift: 24/7 rotational (including weekends)
  
• Reports To: OT SOC Lead / OT Security Manager
  
• Focus: Incident analysis, detection, and response within ICS/OT environments (SCADA, PLCs, DCS, etc.).
  

Key Responsibilities

• Analyze OT-specific security events/incidents using SIEM and OT monitoring tools.
  
• Perform root cause analysis & create incident timelines for forensic use.
  
• Apply incident response frameworks (NIST, MITRE ATT&CK ICS, Cyber Kill Chain).
  
• Investigate malware and suspicious artifacts in OT networks using threat intel & sandbox tools.
  
• Analyze logs, network traffic, and industrial protocols (Modbus, DNP3, OPC).
  
• Investigate anomalous device communications and unauthorized access.
  
• Collaborate with OT engineers, vendors, IT SOC & CIR teams.
  
• Fine-tune SIEM rules/detection logic to cut false positives.
  
• Update SOC playbooks & knowledgebase.
  
• Conduct OT threat hunting (behavioural & attack-path based).
  

Technical Skills

• OT/ICS Protocols: Modbus, DNP3, OPC, industrial network segmentation.
  
• OT Security Tools: Nozomi, Claroty, Dragos (must-have exposure).
  
• Compliance & Frameworks: ISA/IEC 62443, NIST SP 800-82, NIST CSF, ISO 27001.
  
• SIEM Platforms: Sentinel, Splunk, QRadar.
  
• Security Tech Knowledge: Firewalls, proxies, WAFs, segmentation in OT networks.
  
• Threat Intel/Malware Tools: THOR Scanner, VMRay, Recorded Future (good-to-have).
  
• Vulnerability/Patch Management: Especially in environments with limited patch windows.