OT Cyber Threat Intel Lead for Critical Infrastructure

MITRE; McLean (VA); On-site; USD 159,000 - 238,000; Full time

Job summary

MITRE is seeking an Operational Technology (OT) Cyber Threat Intelligence Lead to bridge OT threat intel and automated adversary emulation. You will analyze adversary TTPs affecting ICS, SCADA, and Space OT, translating findings into operational behaviors for deployment in Caldera-based OT emulations.

The role requires 2+ years in OT threat analysis, strong knowledge of industrial protocols, and active Top Secret/SCI eligibility.

Qualifications

• 8+ years of related experience with bachelor’s degree (or 6 years with master’s, 3 years with PhD).
• Degree in Computer Science, Cybersecurity, Information Systems, Intelligence Studies, Strategic Intelligence, or related field.
• Minimum 2 years in OT/ICS/SCADA/Space OT threat analysis or security.
• Familiarity with industrial protocols and Purdue Model Levels 0–3.
• Experience applying ATT&CK for IC, SPARTA, or Cyber Kill Chain to analyze campaigns.
• Must have active Top Secret and eligible for Top Secret/SCI clearance; U.S. citizen.
• On-site presence: 3 days/week at MITRE/government locations in NCR.

Responsibilities

• Adversary Behavior Deconstruction: analyze real-world OT threat intel to identify behaviors and patterns.
• Emulation Team Alignment: translate OT intel into requirements for emulation capabilities (Caldera for OT).
• OT Threat Tracking: track APTs targeting critical infrastructure and space OT environments.
• Sponsor Program Guidance: advise sponsors on OT threat intelligence programs and defense strategies.
• Risk & Susceptibility Analysis: conduct OT-focused risk assessments using ATT&CK for IC, SPARTA.
• Technical Artifact Delivery: create briefings and attack flow mappings for engineering and leadership.

Skills

OT threat intelligence

ICS/OT security

Adversary emulation

Caldera for OT

Network protocol knowledge

Threat modeling

ATT&CK for IC / SPARTA

Education

Degree in Computer Science, Cybersecurity, Information Systems, Intelligence Studies, Strategic Intelligence, or related field

Tools

Wireshark

Zeek

Caldera for OT

Industrial protocols knowledge (Modbus TCP, DNP3, OPC UA/DA, Ethernet/IP)

Job description

MITRE is seeking an Operational Technology (OT) Cyber Threat Intelligence Lead to bridge OT threat intel and automated adversary emulation. You will analyze adversary TTPs affecting ICS, SCADA, and Space OT, translating findings into operational behaviors for deployment in Caldera-based OT emulations.

The role requires 2+ years in OT threat analysis, strong knowledge of industrial protocols, and active Top Secret/SCI eligibility.