OT Cybersecurity Specialist – ICS & Incident Response

Heineken; Poland; On-site; PLN 180,000 - 280,000; Full time

Job summary

HEINEKEN Kraków is seeking a Cyber Security Specialist focused on OT/industrial environments to strengthen the OT capabilities of the Cyber Defense Operations Threat Response (CDO-TR) team. You will investigate alerts related to PLCs, HMIs, historians, and engineering workstations and drive incident response for IT and OT environments.

The role requires 5+ years in Operational Technology with a strong cyber security focus, knowledge of SCADA/DCS/PLCs, and collaboration across IT and OT teams.

Qualifications

• Bachelor's degree or equivalent experience.
• Knowledge of SCADA, DCS, PLCs, RTUs, and HMIs.
• Knowledge of industrial protocols (Modbus, OPC, DNP3).
• Knowledge of MITRE ATT&CK for ICs.
• Understanding of authentication and remote access controls.
• 5+ years of experience in Operational Technology with a strong focus on Cyber Security.
• Experience in manufacturing, energy, or utilities.
• Experience with OT security tools (Nozomi, Claroty, Dragos, Defender for IoT).
• Familiarity with IT/OT hybrid environments.
• Experience with ITIL frameworks.
• Ability to translate technical issues into business and operational impact.
• Strong collaboration skills across IT and OT teams.
• Ability to work in high‑pressure situations.
• Strong analytical and investigation skills.
• Proactive mindset with a strong sense of ownership.
• Strong communication and stakeholder management skills.
• Continuous learning attitude.
• Self‑organizing skills.
• Ability to mentor junior staff.

Responsibilities

• Developing ICS‑specific incident response procedures and playbooks.
• Investigating alerts related to PLCs, HMIs, historians, and engineering workstations.
• Supporting OT monitoring content and integrations development.
• Conducting threat detection and hunting in IT & OT environments.
• Performing triage, investigation, containment, and recovery.
• Coordinating with SOC teams, security champions, and vendors.
• Providing remote/on‑site incident response support.
• Overseeing external vendors and service providers.
• Driving continuous improvement via lessons learned.
• Hosting duty assignment as the primary or backup incident handler of the week for the duty duration, typically these are two‑week schedules aligned within the responder's team, at least a quarter in advance.
• Maintaining 24/7 readiness and response capability for cybersecurity incidents.

Skills

OT security

Incident response

Threat hunting

Scripting (Python PowerShell)

Communication

Stakeholder management

Mentorship

Education

Bachelor's degree

Tools

Nozomi

Claroty

Dragos

Defender for IoT

Job description

HEINEKEN Kraków is seeking a Cyber Security Specialist focused on OT/industrial environments to strengthen the OT capabilities of the Cyber Defense Operations Threat Response (CDO-TR) team. You will investigate alerts related to PLCs, HMIs, historians, and engineering workstations and drive incident response for IT and OT environments.

The role requires 5+ years in Operational Technology with a strong cyber security focus, knowledge of SCADA/DCS/PLCs, and collaboration across IT and OT teams.