Job Summary
The OT Security SME (L2) is responsible for monitoring, administration, troubleshooting, and support of Operational Technology (OT) cybersecurity platforms, with a primary focus on OPSWAT and Nozomi Networks solutions. The role involves securing industrial control systems (ICS), SCADA environments, manufacturing networks, and critical infrastructure through threat detection, asset visibility, vulnerability management, and network monitoring. The L2 engineer acts as an escalation point for L1 operations, performs incident analysis, supports security investigations, and collaborates with plant operations, IT security, and engineering teams to ensure a secure OT environment.
Key Responsibilities
Key Responsibilities OT Security Monitoring & Operations Monitor OT security alerts, incidents, and anomalies using Nozomi Networks. Investigate suspicious activities in ICS/SCADA environments. Perform event analysis, triage, and incident resolution within defined SLAs. Escalate critical threats and coordinate response activities with SOC and OT teams. Nozomi Administration & Support Administer and maintain Nozomi Guardian/Central Management platforms. Configure asset discovery and network monitoring policies. Validate OT asset inventory and communication baselines. Monitor industrial protocols such as: Modbus DNP3 OPC BACnet PROFINET EtherNet/IP OPSWAT Administration & Support Manage OPSWAT MetaDefender solutions. Configure malware scanning policies. Support secure file transfer and removable media security controls. Manage endpoint compliance and file sanitization activities. Monitor and resolve issues related to OT endpoint protection. Vulnerability & Threat Management Assist in identifying vulnerabilities across OT assets. Review Nozomi risk assessments and threat intelligence alerts. Recommend remediation actions based on business and operational impact. Track vulnerability remediation activities with infrastructure and plant teams. Incident Response Participate in OT cyber incident investigations. Perform forensic data collection and analysis when required. Document findings and contribute to root cause analysis (RCA). Support containment and recovery activities. Compliance & Governance Support implementation of OT security standards: ISA/IEC 62443 NIST Cybersecurity Framework NERC CIP (where applicable) ISO 27001 Maintain operational documentation and security runbooks. Participate in audits and compliance reviews. Continuous Improvement Identify opportunities to improve OT security visibility and monitoring. Develop dashboards, reports, and security metrics. Support OT security enhancement projects and technology upgrades.
Skill Requirements
Required Technical Skills Mandatory Skills OT/ICS Security Operations Nozomi Guardian Platform Administration OPSWAT MetaDefender Administration Industrial Control Systems (ICS) SCADA Security Network Security Concepts Threat Detection and Incident Response Vulnerability Assessment Security Monitoring Tools Preferred Skills SIEM Platforms (Microsoft Sentinel, Splunk, QRadar) Wireshark Packet Analysis Palo Alto / Check Point / Fortinet Firewalls Microsoft Defender for IoT Network Access Control (NAC) Industrial Protocol Analysis SOC Operations Experience Linux and Windows Server Administration
Other Requirements
Required Technical Skills Mandatory Skills OT/ICS Security Operations Nozomi Guardian Platform Administration OPSWAT MetaDefender Administration Industrial Control Systems (ICS) SCADA Security Network Security Concepts Threat Detection and Incident Response Vulnerability Assessment Security Monitoring Tools Preferred Skills SIEM Platforms (Microsoft Sentinel, Splunk, QRadar) Wireshark Packet Analysis Palo Alto / Check Point / Fortinet Firewalls Microsoft Defender for IoT Network Access Control (NAC) Industrial Protocol Analysis SOC Operations Experience Linux and Windows Server Administration