Lead OT Cyber Threat Intelligence for Infrastructure

Mitre Corporation; Fort Meade (MD); On-site; USD 173,000 - 259,000; Full time

Job summary

MITRE’s Critical Infrastructure Protection Department (L561) is seeking an Operational Technology (OT) Cyber Threat Intelligence Lead to bridge the gap between deep OT threat intelligence and automated adversary emulation. In this role, you will analyze real-world adversary TTPs targeting industrial control systems (ICS), SCADA, and Space OT environments.

You will distill complex OT threat reporting into operational behaviors, network communication patterns, and protocol mechanics—enabling our

Qualifications

• Minimum 10 years of related experience with a bachelor’s degree; or 8 years and a master’s degree; or a PhD with 5 years’ experience; or equivalent combination of related education and work experience.
• Education: Degree in Computer Science, Cybersecurity, Information Systems, Intelligence Studies, Strategic Intelligence, or related field.
• Direct OT Environment Experience: Minimum 2 years of hands‑on experience analyzing, securing, or threat-modeling Operational Technology (OT), Industrial Control Systems (ICS), SCADA environments, or Space OT systems.
• Industrial Protocol & Control Architecture Familiarity: Working understanding of common industrial communication protocols (e.g., Modbus TCP, DNP3, OPC UA/DA, Ethernet/IP) and lower‑level control architecture (Purdue Model Levels 0–3).
• ICS Threat Framework Application: Demonstrated experience applying ATT&CK for ICS, SPARTA, or Cyber Kill Chain for ICS to dissect adversary campaigns and analyze cyber‑physical attack paths.
• Must have an active Top Secret U.S Government issued Security Clearance and must be eligible to obtain and maintain a Top Secret/SCI U.S Government issued Security Clearance. Per the U.S. Government’s eligibility requirements, you must be a U.S Citizen to be considered for a security clearance.
• This position requires a minimum of 3 days a week on-site.

Responsibilities

• Adversary Behavior Deconstruction: Analyze real-world ICS/OT threat intelligence (e.g., PIPEDREAM, INCONTROLLER, Industroyer) to identify specific adversary behaviors, target device types, and network communication patterns.
• Emulation Team Alignment: Translate OT threat intelligence into concrete technical requirements, attack flows, and protocol parameters for developers building automated emulation capabilities (e.g., Caldera for OT).
• OT Threat Tracking: Track and characterize advanced persistent threats (APTs) targeting critical infrastructure, defense industrial base assets, and space system OT environments using unclassified and classified intel sources.
• Sponsor Program Guidance: Advise government sponsors and critical infrastructure owner/operators on developing OT-specific threat intelligence programs and adopting threat-informed defense strategies.
• Risk & Susceptibility Analysis: Conduct OT-focused threat modeling, mission impact analyses, and cyber-physical risk assessments using frameworks such as ATT&CK for ICS and SPARTA.
• Technical Artifact Delivery: Produce actionable technical briefs, attack flow mappings, and strategic briefings tailored for both technical engineering teams and leadership.

Skills

OT threat intel

ICS/OT analysis

Adversary emulation

Threat modeling

Education

Bachelor's in CS/Cybersecurity/IS

Master's or PhD preferred

Tools

Caldera

Wireshark

CyberSentry

SIEM

Job description

MITRE’s Critical Infrastructure Protection Department (L561) is seeking an Operational Technology (OT) Cyber Threat Intelligence Lead to bridge the gap between deep OT threat intelligence and automated adversary emulation. In this role, you will analyze real-world adversary TTPs targeting industrial control systems (ICS), SCADA, and Space OT environments.

You will distill complex OT threat reporting into operational behaviors, network communication patterns, and protocol mechanics—enabling our