OT / ICS SOC Analyst

Chenega Corporation; Huntsville (AL); On-site; USD 90,000 - 120,000; Full time

Job summary

Chenega Military, Intelligence & Operations Support (MIOS) seeks an OT/ICS SOC Analyst in Huntsville, AL to monitor, detect, and respond across IT/OT environments. The role emphasizes advanced monitoring, threat hunting, incident response coordination, and threat analysis to protect critical infrastructure and national security missions.

You will work with SIEM, XDR, NDR platforms; apply MITRE ATT&CK, maintain playbooks, and mentor junior analysts while aligning with DoD-level standards,

Qualifications

• OT/ICS security operations, security monitoring, incident response.

Responsibilities

• Monitor and analyze security telemetry across network, endpoint, identity, cloud, application, email, and other sources.
• Investigate escalated or complex cybersecurity events to determine validity, scope, and impact.
• Correlate alerts with asset criticality, vulnerability information, threat intelligence, user behavior, and historical activity.
• Lead or perform incident triage and analysis; document evidence and findings.

Skills

OT/ICS Protocol Analysis

Purdue Model & Boundary Defense

Safe Operational Response

Adversary Tradecraft in ICS

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Technology, Software Engineering, Data Science, or a related field

Associate's degree with 5+ years of relevant experience

High school diploma or GED with 7+ years of relevant experience

Tools

Dragos Platform

Claroty CTD

Nozomi Guardian

Tenable OT (Indegy)

ForeScout eyeInspect

Job description

Summary

OT/ICS SOC Analyst

Huntsville, Alabama

Are you ready to enhance your skills and build your career in a rapidly evolving business climate? Are you looking for a career where professional development is embedded in your employer's core culture? If so, Chenega Military, Intelligence & Operations Support (MIOS) could be the place for you! Join our team of professionals who support large-scale government operations by leveraging cutting-edge technology and take your career to the next level!

Chronos Operations (CO) is a wholly-owned subsidiary of Chenega Corporation, an Alaska Native Corporation based in Anchorage, AK. Belonging to the Military, Intelligence, and Operations Support (MIOS) Strategic Business Unit (SBU), Chronos has a culture rooted in integrity, respect, and exceptional performance. Chronos is headquartered in Colorado Springs, CO, and provides mission-critical services in Advanced Analytics & AI, Software Engineering, Cybersecurity, Information Technology, and Intelligence.

We deliver essential cyber services to our customers in support of their missions to sustain the national security and economic interests of our nation.

The OT / IC SOC Analyst performs advanced monitoring, threat hunting, anomaly investigation, incident response coordination, and threat analysis across converged IT/OT environments, Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA) platforms, Distributed Control Systems (DCS), and mission support networks.

Operating with increased autonomy within established operational authorities and rules of engagement, the analyst correlates telemetry across the Purdue Model (Levels 1-3+), evaluates physical process anomalies alongside digital indicators, ensures response measures prioritize personnel safety and process reliability, and continuously improves OT-specific detection mechanisms, playbooks, and defensive readiness.

Responsibilities

• Monitor and analyze security telemetry across network, endpoint, identity, cloud, application, email, and other enterprise sources using approved SIEM, XDR, NDR, and security analytics platforms.
• Investigate escalated or complex cybersecurity events to determine validity, scope, affected assets and identities, potential mission impact, and required response actions.
• Correlate alerts with asset criticality, vulnerability information, threat intelligence, user behavior, and historical activity to develop evidence-based analytical conclusions.
• Lead or perform incident triage and analysis; collect, preserve, and document relevant evidence in accordance with established procedures and evidence-handling requirements.
• Execute authorized containment and response actions, including host isolation, account restriction, indicator blocking, or other approved measures, and coordinate eradication and recovery activities with responsible stakeholders.
• Develop clear incident records, analytical findings, timelines, and technical reports; communicate status, risk, and recommended actions to SOC leadership and mission stakeholders.
• Apply threat intelligence, indicators of compromise, adversary tactics, techniques, and procedures, and frameworks such as MITRE ATT&CK to identify related activity and support defensive recommendations.
• Review and validate findings, recommendations, and summaries generated by automated analytics, machine learning, or AI-enabled cybersecurity capabilities before operational use.
• Tune alerts and detection logic, recommend telemetry improvements, and help reduce false positives, coverage gaps, and analyst workload in coordination with detection engineering or platform owners.
• Develop, test, maintain, and improve incident response playbooks, standard operating procedures, queries, dashboards, and repeatable analytical workflows.
• Participate in or facilitate post-incident reviews and lessons-learned activities; translate findings into corrective actions and measurable operational improvements.
• Mentor SOC Analyst I personnel, provide quality reviews of escalated cases, and share technical knowledge across shifts and teams.
• Support cyber exercises, readiness assessments, recovery validation, and continuous improvement activities as directed by the SOC Lead.
• Perform additional duties as assigned.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Technology, Software Engineering, Data Science, or a related field and 3+ years of relevant experience.
• Or applicants may meet one of the following substitutions:
  • Associate's degree and 5+ years of relevant experience.
  • High school diploma or GED equivalent and 7+ years of relevant experience.
  • Relevant experience must include cybersecurity operations, security monitoring, network defense, incident response, threat analysis, system administration, or a closely related information technology discipline. At least 2+ years must involve SOC, cyber defense, or incident response functions.
• Active DOD IAT Level II Certification or higher is required.
• Active Secret clearance with the ability to obtain and maintain TS/SCI eligibility.

Preferred Qualifications

• Active TS/SCI clearance.
• 5+ or more years of relevant cybersecurity experience, including 2+ or more years in a SOC, cyber defense, or incident response environment.
• Experience investigating endpoint, network, identity, cloud, email, or application security events using SIEM, EDR/XDR, NDR, SOAR, vulnerability management, or threat intelligence platforms.
• OT/ICS Security Tooling: Hands-on operational experience with leading OT security and asset inventory platforms such as Dragos Platform, Claroty Continuous Threat Detection (CTD), Nozomi Networks Guardian, Tenable OT (Indegy), or ForeScout eyeInspect.
• Working familiarity with programmable logic controllers (PLCs), remote terminal units (RTUs), human-machine interfaces (HMIs), distributed control systems (DCS), and safety instrumented systems (SIS) manufactured by vendors such as Rockwell Automation/Allen-Bradley, Siemens, Schneider Electric, Emerson, or GE.
• Experience developing or tuning detection logic, analytical queries, dashboards, automation, or incident response playbooks.
• Experience applying MITRE ATT&CK, threat intelligence, and adversary behaviors to investigations and defensive recommendations.
• Experience supporting the Department of Defense, Federal Civilian, Intelligence Community, or critical infrastructure missions.
• Role-Specific Certifications:
  • GIAC Global Industrial Cyber Security Professional (GICSP)
  • GIAC Response and Industrial Defense (GRID)
  • GIAC Critical Infrastructure Protection (GCIP)
  • ISA/IEC 62443 Cyber Security Specialist/Expert
  • GIAC Certified Incident Handler (GCIH) or CISSP

Knowledge, Skills and Abilities

• OT/ICS Protocol Analysis: Demonstrated ability to dissect and analyze industrial protocol traffic (Modbus TCP/RTU, DNP3, CIP, Ethernet/IP, OPC, BACnet, PROFINET, S7comm) and identify anomalies such as unauthorized command functions or out-of-spec register writes.
• Purdue Model & Boundary Defense: Advanced understanding of industrial network segmentation, IDMZs, jump hosts, dual-homed servers, unidirectional security gateways (data diodes), and boundary firewall rulebases separating Level 4/5 IT from Level 0-3 OT.
• Safe Operational Response: Strict appreciation of the primacy of safety, physical reliability, and process availability over data confidentiality, understanding that standard IT containment methods (e.g., abrupt host isolation or aggressive vulnerability scanning) can cause equipment trips or physical hazards.
• Adversary Tradecraft in IC S: Knowledge of real-world OT/ICS threat actors, destructive malware families (e.g., Industroyer/CrashOverride, TRITON/Trisis,