OT Security Engineer

Cynet Systems•Dallas, TX

About The Position

The OT Security Engineer monitors security alerts from SIEM, SOAR, and IIDS tools and investigates potential incidents affecting OT systems. The role analyzes logs common to ICS/SCADA environments, triages alerts, and distinguishes true positives from false positives and benign events. The engineer works with Shift Leads to refine detection rules, reduce false positives, and develop use cases to improve OT detection capabilities. The role also contributes to runbooks, standard operating procedures, and incident response playbooks; documents triage activities in the SOC ticketing system; participates in training and simulations; and stays current on applicable OT security standards and frameworks. Success in the position involves prioritizing alerts in a fast-paced environment, helping improve MTTD and MTTR, meeting SOC SLAs, and collaborating across teams to enhance security posture. The position operates in a 24/7 shift-based SOC environment and may require covering for teammates and occasional after-hours support.

Requirements

High school diploma or equivalent required.
2–4 years of experience in a cybersecurity role.
Strong analytical skills and attention to detail.
Ability to communicate complex technical information clearly, both verbally and in writing, to technical and non-technical audiences.
Ability to work effectively in a 24/7 shift-based SOC environment, including covering for teammates and providing occasional after-hours support.
Foundational understanding of industrial protocols such as DNP3, Modbus, and IEC 104.
Experience with security technologies including SIEM, SOAR, and IIDS platforms.

Nice To Haves

Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field.
1–2 years of experience working with OT/SCADA environments.
Relevant certifications such as Network+, Security+, or CySA+.

Responsibilities

Monitor security alerts from SIEM, SOAR, and IIDS tools and investigate potential incidents affecting OT systems.
Analyze ICS/SCADA logs to identify indicators of compromise.
Perform initial alert triage, assessing validity, severity, and priority using log analysis, event data, and threat intelligence.
Differentiate true positives, false positives, and benign events to minimize unnecessary escalations.
Work with Shift Leads to refine detection rules, reduce false positives, and develop new OT detection use cases.
Contribute to creating and maintaining runbooks, standard operating procedures, and incident response playbooks.
Document alert triage activities, findings, and decisions in the SOC ticketing system.
Participate in training sessions and simulations to stay current on cyber threats, OT security practices, and monitoring tools.
Stay current on relevant OT security standards and frameworks, including NERC-CIP (specifically 2/3), NIST CSF, Client Model for Industrial Control Systems, and ISO 27001.
Prioritize and manage alerts effectively in a fast-paced environment.
Contribute to improvements in MTTD and MTTR and maintain adherence to SOC SLAs.
Collaborate with cross-functional teams to enhance the security posture.
Cover for teammates and provide occasional after-hours support as needed.