OT Incident Response Analyst

Job description

The OT SOC L3 Analyst serves as the senior technical authority in the OT Security Operations Center, responsible for advanced threat hunting, OT-aware digital forensics and incident response, detection engineering, and mentoring L1/L2 analysts. Leads response to complex, high‑severity OT incidents, develops OT detection capabilities, and translates threat intelligence into actionable detections.

Requirements

• Bachelor's degree in Cybersecurity, Computer/Electrical/Instrumentation Engineering or related field
• 6–10+ years of cybersecurity experience
• minimum 4 years in OT/ICS security operations, DFIR or threat hunting
• deep expertise in OT protocols and ICS architectures (DCS, SCADA, PLC, SIS) and the Purdue model
• proven experience leading OT/ICS incident response and forensic investigations
• strong command of OT monitoring platforms (the employer, Claroty, Dragos, Tenable OT, Defender for IoT) and SIEM detection engineering (Splunk, QRadar, Sentinel)
• advanced knowledge of MITRE ATT&CK for ICS, NIST SP 800-82, ISA/IEC 62443, and NCA OTCC
• preferred certifications: GRID, GCIP, GICSP, GCFA or GREM
• vendor expert‑level certifications (Dragos, Claroty, the employer)
• expert analytical, forensic and reverse‑engineering/malware‑analysis skills in OT context
• strong leadership, mentoring and stakeholder‑management abilities
• sound judgment balancing cybersecurity response with process safety and operational availability
• excellent written and verbal communication in English, Arabic strongly preferred
• available for on‑call escalation and incident leadership outside normal hours.

Skills