Operational Technology Cyber Threat Intelligence, Principal
About The Position
MITRE’s Critical Infrastructure Protection Department (L561), within the Cyber-Physical Systems Division, is seeking an Operational Technology (OT) Cyber Threat Intelligence Lead to connect deep OT threat intelligence with automated adversary emulation. The role analyzes real-world adversary tactics, techniques, and procedures targeting industrial control systems (ICS), SCADA, and Space OT environments. It translates complex threat reporting into operational behaviors, network communication patterns, and protocol mechanics that enable software engineers to build realistic automated attack scenarios, including in Caldera for OT. The department develops solutions for sponsor challenges tied to national security and public-sector missions. Its focus areas include infrastructure susceptibility analysis, safety engineering, threat-informed recommendations, critical infrastructure threat detection and adversary emulation, OT device and Space OT security, cross-sector interdependency analysis, and defense and civilian critical-infrastructure expertise. The role also advises government sponsors and infrastructure owner/operators, assesses cyber-physical risk, and produces technical and strategic briefings. The position requires at least three days per week onsite. Candidates must have an active Top Secret U.S. Government-issued clearance and be eligible to obtain and maintain a Top Secret/SCI clearance. U.S. citizenship is required for security-clearance eligibility.
Requirements
- Typically, at least 10 years of related experience with a bachelor’s degree, 8 years with a master’s degree, or 5 years with a Ph.D., or an equivalent combination of related education and work experience.
- A degree in Computer Science, Cybersecurity, Information Systems, Intelligence Studies, Strategic Intelligence, or a related field.
- At least 2 years of hands-on experience analyzing, securing, or threat-modeling OT, ICS, SCADA, or Space OT environments; enterprise IT security experience alone does not meet this requirement.
- Working understanding of common industrial communication protocols, such as Modbus TCP, DNP3, OPC UA/DA, and Ethernet/IP, and lower-level control architecture including Purdue Model Levels 0–3.
- Demonstrated experience applying ATT&CK for ICS, SPARTA, or Cyber Kill Chain for ICS to dissect adversary campaigns and analyze cyber-physical attack paths.
- An active Top Secret U.S. Government-issued security clearance and eligibility to obtain and maintain a Top Secret/SCI U.S. Government-issued security clearance.
- U.S. citizenship, as required for security-clearance eligibility.
Nice To Haves
- An advanced degree in a relevant technical field.
- An active TS/SCI security clearance.
- Experience creating hybrid IT/OT threat models, building adversary-emulation content, and developing targeted OT detection analytics.
- Experience with large-scale security logging frameworks such as CyberSentry or enterprise SIEM architecture.
- Experience analyzing industrial-protocol packet captures using tools such as Wireshark or Zeek to distinguish normal operations from malicious commands.
- Experience partnering with red teams, penetration testers, or adversary-emulation developers on threat-simulation exercises.
- Relevant OT/ICS certifications, such as GIAC Global Industrial Cybersecurity Professional (GICSP), GIAC Response and Industrial Defense (GRID), or GIAC Critical Infrastructure Protection (GCIP).
- Experience partnering with organizations such as CISA, DoD, or Sector Risk Management Agencies (SRMAs) on threat reporting and mitigation guidance.
Responsibilities
- Analyze real-world ICS/OT threat intelligence, including threats such as PIPEDREAM, INCONTROLLER, and Industroyer, to identify adversary behaviors, target device types, and network communication patterns.
- Translate OT threat intelligence into technical requirements, attack flows, and protocol parameters for developers building automated emulation capabilities such as Caldera for OT.
- Track and characterize advanced persistent threats targeting critical infrastructure, defense industrial base assets, and Space OT environments using unclassified and classified intelligence sources.
- Advise government sponsors and critical-infrastructure owner/operators on OT-specific threat intelligence programs and threat-informed defense strategies.
- Conduct OT-focused threat modeling, mission-impact analyses, and cyber-physical risk assessments using frameworks such as ATT&CK for ICS and SPARTA.
- Produce actionable technical briefs, attack-flow mappings, and strategic briefings for engineering teams and leadership.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Principal
