OT SOC Analyst - Operational Technology

Morson Edge; England; Hybrid; GBP 60,000 - 80,000; Full time

Job summary

A technology solutions provider in the UK is seeking an OT SOC Analyst to lead cybersecurity incident responses. This role involves threat hunting, policy creation, and incident management, ensuring protection of network systems and data. The ideal candidate will have extensive SOC and CSIRT experience, with a strong focus on critical environments. The position offers a hybrid work model, requiring on-site presence in Crawley two days a week.

Qualifications

• Extensive experience in leading end-to-end cyber incidents.
• Strong background in SOC Level 3 and CSIRT Level 3.
• Experience in CNI / Defence / Business Critical environments.

Responsibilities

• Conduct threat hunting across OT/IT environments.
• Create SOC policies and standards.
• Lead high-severity incident responses.
• Develop automated workflows for detection and response.
• Perform forensic analysis and recommend actions.

Skills

Cyber Incident Leadership Experience

SOC Level 3 Experience

CNI / Defence Environment Experience

Threat Hunting Experience

Runbook & Playbook Authoring

Education

Cyber and OT Certification

Job description

OT SOC Analyst (Operational Technology)

Outside IR35

Duration: 6 9 months

Location: Crawley, Hybrid 2 days per week on site

Overview of project:

The role of an Incident Response (CSIRT) / Security Operations Centre (SOC) Level 3 Analyst is to respond to high‑severity cyber security incidents and/or escalated events and alerts then, using experience combined with industry tools and techniques, expediate a containment, eradication and recovery strategy to minimise business impact and ensure UK Power Networks (UKPN) network systems and customer data are protected from cyber threats.

Overview of role and responsibilities:

• Threat Hunting: Analyse intel and IOCs to find and remove hidden threats across UKPN's OT/IT environments.
• Policy: Create SOC policies, standards and procedures aligned with best practice.
• Logs: Ensure all logs feed into the SIEM and build use cases to detect anomalous activity.
• Incident Response: Lead high‑severity incidents, improve playbooks and manage remediation, communication and reporting.
• SOAR: Develop automated workflows to streamline detection, enrichment and response.
• Forensics: Perform forensic analysis across multiple data sources and recommend containment and eradication actions.
• Crisis Testing: Take part in cyber‑attack simulations to strengthen resilience.
• Reporting: Improve reporting dashboards and key security metrics.
• Tooling: Support and maintain security tools and platforms for threat prevention, detection and response.
• Audit: Support SOC2/NCSC CAF/ISO27001 audits and ensure compliance.
• Continuous Improvement: Automate and enhance monitoring, detection and response based on evolving threats.

Skills, experience and previous achievements required:

Essential

• Extensive End to End Cyber Incident Leadership Experience
• Extensive SOC L3 / CSIRT L3 Experience
• Extensive CNI / Defence / Business Critical Environment Experience

Desirable

• Threat Hunting Experience
• Threat Hunting Strategy Mindset
• Runbook & Playbook Authoring
• Lessons Learned / Root Cause Analysis Leader
• Experience working with and enhancing security monitoring tooling
• Extensive IT/OT Systems Experience
• Extensive CNI & OT Environment Awareness
• Experience aligning with organisational requirements and contributing to audit readiness

Tickets/Qualifications/Accreditations required to carry out the role:

• Desirable - Cyber and OT Certification

Previous companies of interest:

• MOD or similar