OT Cyber SOC Analyst — SIEM & IR for OT/ICS

Rockwell Automation; Madrid; Hybrid; EUR 55,000 - 75,000; Full time

Benefits offered by this job

Volunteer Paid Time off after 6 months

Company volunteer and donationMatching

On-demand digital course library

Mindfulness programs

Employee Assistance Program

OnTrack wellbeing program

Other local benefits

Job summary

Rockwell Automation is seeking a Cybersecurity Analyst to join the OT Security team in Madrid or Barcelona, with a hybrid work arrangement. You will monitor OT security events, respond to incidents, and collaborate with OT/ICS teams to strengthen Purdue-model based architectures and asset identification.

Responsibilities include monitoring alerts with SIEM and OT tools, conducting incident response, tuning detections, and improving SOC procedures.

Qualifications

• Bachelor's Degree in Computer Science / Engineering / Telecommunications / SysAdmin / Networking
• 2+ years of SOC operations or analyst experience
• Experience with SIEM, log analysis, alert tuning, and understanding detection logic
• Hands-on familiarity with OT security tooling such as Claroty, Nozomi, or similar platforms
• Knowledge of EDR, AV, and orchestration platforms and how they support monitoring workflows
• Networking knowledge of OT/ICS protocols and Purdue model understanding
• Working knowledge of Windows/Linux/Mac security components
• Fluency in English and Spanish

Responsibilities

• Monitor and analyze security alerts in OT environments using SIEM, OT security tools, and EDR/AV platforms.
• Respond to security incidents (IR) - conducting investigations, correlating events, identifying attack vectors, and implementing mitigation actions.
• Maintain and improve SOC procedures related to alert handling, vulnerability reporting, and escalation processes.
• Perform log analysis and fine‑tuning detections by enhancing SIEM rules, tuning alerts, and supporting the development of detection logic.
• Collaborate with OT/ICS teams on asset identification, vulnerability assessment, architecture reviews (ICS/SCADA, Purdue model), and recommending security improvements.

Skills

SIEM experience

OT/ICS security tooling

Incident response

English & Spanish fluency

Education

Bachelor's Degree in Computer Science / Engineering / Telecommunications / SysAdmin / Networking

Tools

Claroty

Nozomi

EDR/AV

Job description

Rockwell Automation is seeking a Cybersecurity Analyst to join the OT Security team in Madrid or Barcelona, with a hybrid work arrangement. You will monitor OT security events, respond to incidents, and collaborate with OT/ICS teams to strengthen Purdue-model based architectures and asset identification.

Responsibilities include monitoring alerts with SIEM and OT tools, conducting incident response, tuning detections, and improving SOC procedures.