Job Search

We are seeking an experienced OT SIEM Engineer to support the monitoring, detection and investigation of cyber security events across operational technology (OT) and industrial control system (ICS) environments. You will help design, implement and maintain security information and event management capabilities, ensuring that relevant logs and telemetry are collected, normalised and analysed effectively. Working closely with OT, IT, network and security teams, you will improve visibility across critical infrastructure while maintaining a strong focus on safety, availability and operational resilience.

Your responsibilities will include developing and tuning SIEM use cases, correlation rules, dashboards and alerts for OT environments; onboarding and managing data sources such as firewalls, endpoint technologies, network monitoring tools, industrial devices and remote access platforms; and investigating suspicious activity, escalating incidents and supporting effective remediation. You will contribute to threat hunting, incident response and forensic analysis, helping to identify indicators of compromise and emerging attack techniques. The role will also involve maintaining technical documentation, supporting compliance and assurance activities, participating in vulnerability and risk assessments, and recommending improvements to monitoring coverage and detection capability.

Applicants should have practical experience working with SIEM platforms, preferably in environments involving operational technology, industrial control systems or other critical infrastructure. A strong understanding of security monitoring, log management, incident response, network protocols and common attack frameworks such as MITRE ATT&CK for ICS is required. Experience with platforms such as Microsoft Sentinel, Splunk, QRadar or equivalent technologies would be beneficial, as would knowledge of SCADA, DCS, PLC and historian environments. Relevant cyber security qualifications or demonstrable equivalent experience are desirable. You will need excellent analytical and communication skills, a methodical approach to problem-solving, and the ability to work collaboratively in a complex, high-assurance environment. The role may involve occasional on-call support or travel to operational sites.

We are seeking an experienced OT SIEM Engineer to support the development, operation and continual improvement of security monitoring across operational technology environments. You will play a key role in protecting industrial systems, control networks and connected assets by ensuring that relevant security events are collected, analysed and acted upon effectively. Working closely with operational technology, information security, infrastructure and engineering teams, you will help strengthen visibility and resilience across critical environments.

Your responsibilities will include designing, configuring and maintaining SIEM use cases, dashboards, alerts and correlation rules relevant to OT and industrial control systems. You will onboard and validate data sources such as firewalls, network monitoring tools, endpoint technologies, identity services and OT security platforms, ensuring that logs are accurate, appropriately retained and fit for detection purposes. You will investigate security alerts and incidents, undertake threat-led analysis, support incident response activities and contribute to root-cause investigations. You will also tune detection content to reduce false positives, identify gaps in monitoring and develop meaningful reporting for technical and senior stakeholders.

The successful candidate will have practical experience with SIEM technologies and security monitoring, ideally within an OT, ICS, SCADA, manufacturing, energy or similarly complex environment. You should understand common OT protocols, network architectures, asset management principles and the operational constraints associated with industrial systems. Knowledge of threat intelligence, incident response, vulnerability management and relevant frameworks such as MITRE ATT&CK for ICS, NIST or IEC 62443 would be advantageous. Strong analytical and communication skills are essential, alongside the ability to document technical findings clearly and work collaboratively with a range of stakeholders. Relevant security certifications or demonstrable equivalent experience are desirable.