OT Incident Response Consultant — Threat Hunter

Sophos; United States; Remote; USD 130,000 - 180,000; Full time

Benefits offered by this job

Remote-first policy

Job summary

Sophos is seeking an OT Incident Response Consultant to protect industrial environments from evolving cyber threats. You will lead investigations, perform root cause analysis, and advise on remediation to improve OT security and operational resilience.

Responsibilities include threat hunting, security monitoring, and developing OT-specific detection use cases, working closely with customers to reduce risk and enhance cyber defense posture.

Qualifications

• Experience in cybersecurity, incident response, security operations or threat detection.
• 2+ years supporting industrial control systems or OT environments is desirable.
• Understanding of OT/ICSS architectures and operational environments.
• Hands-on with SIEM, event monitoring, detection use cases and alert tuning.
• Experience analyzing firewall logs, IDS/IPS events and network telemetry.
• Strong English communication skills; willingness for 24x7x365 coverage.

Responsibilities

• Lead OT security incident investigations and response.
• Perform root cause analysis to determine threat origin and scope.
• Develop OT-specific detection use cases and security monitoring procedures.
• Tune alerts to reduce noise and improve detection accuracy.
• Provide SME advisory during OT cybersecurity engagements.
• Support clients in strengthening OT security programs and controls.

Skills

Incident response

Threat hunting

Security monitoring

Threat intelligence

SIEM

Network analysis

English communication

Shift work

Tools

SIEM technologies

Firewall logs

IDS/IPS

Network telemetry

Job description

Sophos is seeking an OT Incident Response Consultant to protect industrial environments from evolving cyber threats. You will lead investigations, perform root cause analysis, and advise on remediation to improve OT security and operational resilience.

Responsibilities include threat hunting, security monitoring, and developing OT-specific detection use cases, working closely with customers to reduce risk and enhance cyber defense posture.