OT Security Consultant

EXOS; Houston (TX); On-site; USD 120,000 - 180,000; Full time

Job summary

EXOS is seeking an Operational Technology (OT) Security Consultant to act as an embedded cybersecurity advisor inside a SOC for an industrial client. You will bring deep OT/ICS expertise and Nozomi Networks administration to strengthen monitoring and detection across critical infrastructure environments.

You will collaborate with SOC analysts and engineering teams to tune alerts, develop OT-specific detections, and drive a prioritized monitoring roadmap.

Qualifications

• Bachelor's degree or equivalent in cybersecurity, IT, or engineering.
• 5+ years of hands-on SOC operations, threat detection and monitoring in OT/ICS.
• Experience tuning Nozomi Networks in production environments.
• Experience integrating OT monitoring with Splunk or SIEM technologies.
• Familiarity with IEC 62443 and OT network segmentation principles.
• Strong communication, documentation, and mentoring abilities.

Responsibilities

• Assess Nozomi alerts, policies, use cases and monitoring content.
• Collaborate with security engineering and SIEM stakeholders on roadmaps.
• Tune alert rules, thresholds, asset groupings, and learning profiles.
• Design and implement OT-specific detections and monitoring use cases.
• Evaluate sensor deployment and asset inventory accuracy.
• Enhance Nozomi Networks integration with SIEM platforms.
• Coach SOC analysts on detection improvements and IR activities.
• Create runbooks, tuning docs, and operational procedures.
• Provide recurring reporting on alert volume, false positives and maturity.
• Coordinate with stakeholders and partners to deliver monitoring enhancements.

Skills

OT/ICS security

Nozomi Networks admin

SOC operations

Industrial protocols

Purdue ARC/segmentation

MITRE ATT&CkS ICS mapping

Analytical problem solving

Communication & mentoring

Education

Bachelor's in Cybersecurity/IT/Engineering

5+ years in SOC/OT security

Tools

Nozomi Networks Guardian/Vantage

Splunk/SIEM integration

Job description

EXOS delivers integrated cybersecurity expertise, technology talent services, strategic IT solutions and managed AI services designed to help growing organizations operate securely and scale strategically. For more than 16 years, EXOS has partnered closely with clients to solve complex technology challenges with clarity and confidence. EXOS is a trusted partner known for measurable results, reliable execution and forward-thinking innovation. EXOS builds connected partnerships that strengthen security posture, elevate teams and optimize technology environments so organizations can stay ahead of disruption in an evolving digital landscape. We operate across three divisions:

Cyber, Talent, IT, and AI.

Our Divisions

• EXOS Cyber: Proactive and comprehensive cybersecurity solutions
• EXOS Talent: Workforce scaling and strategic staffing
• EXOS IT: End-to-end technology services for growth
• EXOS AI: Strategic, secure AI solutions

About the Role

Our client is seeking an Operational Technology (OT) Security Consultant to serve as an embedded cybersecurity advisor responsible for enhancing industrial security monitoring and detection capabilities within a Security Operations Center (SOC). This highly collaborative, hands-on role requires deep expertise in Operational Technology (OT), Industrial Control Systems (ICS), and Nozomi Networks administration and tuning.

The consultant will evaluate existing detections and monitoring capabilities, improve alert fidelity, optimize Nozomi configurations, and partner closely with SOC analysts and engineering teams to strengthen visibility across critical infrastructure environments. This position is dedicated to a single customer engagement for approximately 12 months, with the potential for extension.

Key Responsibilities

• Assess and catalog existing Nozomi Networks alerts, policies, use cases, and monitoring content against frameworks such as MITRE ATT&CK for ICS, IEC 62443, regulatory requirements, and vendor best practices.
• Partner with security engineering and SIEM stakeholders to develop and execute a prioritized roadmap for monitoring and detection improvements.
• Tune and optimize alert rules, thresholds, asset groupings, learning profiles, and zone/conduit definitions to improve alert quality and reduce false positives.
• Design and implement new OT-specific detections, custom checks, and monitoring use cases that address identified visibility and coverage gaps.
• Evaluate sensor deployment, passive discovery capabilities, and asset inventory accuracy, providing recommendations to improve monitoring effectiveness.
• Collaborate with SIEM teams to enhance integration between Nozomi Networks and security monitoring platforms, including enrichment, field mapping, event normalization, and correlation logic.
• Coach SOC analysts through detection improvements, investigations, and incident response activities while building operational knowledge across the team.
• Create and maintain runbooks, tuning documentation, use case rationale, and operational procedures to ensure long-term sustainability.
• Provide recurring reporting focused on alert volume trends, false positive reduction, detection coverage improvements, and overall program maturity.
• Coordinate with customer stakeholders, implementation partners, and change management teams to ensure successful delivery of monitoring enhancements.

Required Skills

• Advanced knowledge of Operational Technology (OT) and Industrial Control System (ICS) security practices.
• Hands-on administration, configuration, and tuning experience with Nozomi Networks Guardian and/or Vantage in production environments.
• Strong Security Operations Center (SOC) experience, including threat detection, alert triage, investigation, and content tuning.
• Deep understanding of industrial protocols including Modbus, DNP3, IEC 61850, OPC, and EtherNet/IP.
• Knowledge of Purdue Enterprise Reference Architecture and OT network segmentation principles.
• Experience developing detections and mapping security controls to the MITRE ATT&CK for ICS framework.
• Strong analytical, troubleshooting, and problem-solving skills.
• Excellent communication, documentation, stakeholder management, and mentoring abilities.

Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Engineering, or a related field, or equivalent professional experience.
• 5+ years of cybersecurity experience with hands-on SOC operations, threat detection, and monitoring engineering responsibilities.
• Experience supporting OT/ICS environments within utilities, energy, manufacturing, water, or other critical infrastructure sectors.
• Demonstrated success tuning and administering Nozomi Networks solutions in production environments.
• Experience integrating OT monitoring platforms with Splunk or other SIEM technologies preferred.
• Familiarity with IEC 62443 security standards preferred.
• Experience with passive network monitoring architectures, including TAP and SPAN deployment strategies preferred.
• Previous consulting, advisory, or embedded customer-facing experience preferred.

Preferred Certifications:

• GICSP (Global Industrial Cyber Security Professional)
• GRID (GIAC Response and Industrial Defense)
• GCIA (GIAC Certified Intrusion Analyst)
• CISSP (Certified Information Systems Security Professional)
• Equivalent cybersecurity or industrial security certifications