OT Security Consultant (Splunk)

MatchPoint; Houston (TX); On-site; USD 110,000 - 117,000; Full time

Job summary

MatchPoint is seeking an OT Security Consultant (Splunk) in Houston to lead detection engineering for our SOC. The role requires hands-on Splunk work, OT/ICS security expertise, and collaboration with Nozomi for alert normalization across OT data sources.

You will design SPL searches, optimize detection content, coach analysts, and produce runbooks with clear justification for every change. Expect strong interaction with customer teams and partners in a fast-growing IT security environment.

Qualifications

• Significant hands-on cybersecurity experience in production SOC environments.
• Experience with OT/ICS security monitoring in critical infrastructure contexts.
• Advanced Splunk skills: SPL development, correlation searches, tuning.
• Familiarity with MITRE ATT&CK and ATT&CK for ICS security.
• Understanding OT architectures, Purdue model, and industrial protocols.
• Strong ability to document procedures and coach analysts.

Responsibilities

• Catalogue existing Splunk searches, dashboards, and use cases and identify gaps.
• Co-author a prioritized roadmap with Nozomi lead during initial phase.
• Design and refine SPL correlations and detection content for OT data sources.
• Adjust thresholds and suppression logic to reduce false positives and track impact.
• Review OT log sources and enrichment to ensure reliable detections.
• Collaborate with Nozomi lead to normalize alerts and asset data in Splunk.
• Coach SOC analysts using investigations and OT/IT pivots.
• Create runbooks and tuning rationales for new use cases and training.
• Provide monthly reporting on changes, alert volume, false positives, and coverage.

Skills

Cybersecurity experience

SOC operations

OT/ICS security

Splunk SPL

Detection engineering

ATT&CK awareness

OT network security

Tools

Splunk Enterprise

Nozomi Networks

IEC 62443

Job description

MatchPoint is a fast-growing, young, energetic global IT-Engineering services company with clients across the US. We provide technology solutions to various clients like Uber, Robinhood, Netflix, Airbnb, Google, Sephora and more! More recently, we have expanded to working internationally in Canada, China, Ireland, UK, Brazil and India. Through our culture of innovation, we inspire, build, and deliver business results, from idea to outcome. We keep our clients on the cutting edge of the latest technologies and provide solutions by using industry specific best practices and expertise.

We are excited to be continuously expanding our team. If you are interested in this position, please send over your updated resume. We look forward to hearing from you!

Job Description

Job : OT Security Consultant (Splunk)

Location : Houston, TX - onsite

Duration : 12 Months

Rate : $80 to $85 per hour

Operational Technology (OT) Cybersecurity Consultant to lead Splunk detection engineering for a customer Security Operations Center (SOC). This hands‑on role requires production SOC experience, an understanding of how OT environments differ from traditional IT, and advanced Splunk expertise. The consultant will evaluate current use cases, improve correlation and alert quality, develop new detection content, coach analysts, and create clear documentation that enables the team to sustain the work independently.

Responsibilities:

• Catalogue and assess existing Splunk correlation searches, dashboards, and use cases against an agreed baseline, identifying coverage gaps and noisy rules.
• Co-author a prioritized roadmap with the Nozomi lead during the initial phase of the engagement.
• Design, test, and refine Search Processing Language (SPL) correlation searches, notable event logic, and detection content tailored to OT data sources.
• Recommend and implement approved adjustments to thresholds and suppression logic to reduce false positives, and track the impact of each change.
• Review OT log sources, parsing, normalization, field extraction, and enrichment so detections are based on reliable data.
• Partner with the Nozomi lead to normalize, enrich, and correlate Nozomi alerts and asset data in Splunk.
• Coach SOC analysts using real investigations and teach effective pivots across OT and IT data.
• Create a runbook and tuning rationale for each new or materially changed use case, and teach analysts to build and tune searches independently.
• Provide monthly reporting on changes, rationale, alert volume, false positive rate, and coverage improvement.
• Coordinate with customer teams, implementation partners, change control, and related Splunk workstreams so improvements are delivered smoothly. Qualifications:

Required Qualifications

• Significant cybersecurity experience, including hands‑on SOC work involving triage, investigation, and detection engineering in a production environment; approximately five or more years of overall experience is preferred.
• Experience with OT or Industrial Control System (ICS) security monitoring, ideally in utilities, energy, or critical infrastructure.
• Advanced hands‑on Splunk skills, including SPL, correlation search development, and tuning in a production SOC environment.
• Practical knowledge of detection engineering methods and MITRE ATT&CK, with working familiarity with ATT&CK for IC S.
• Understanding of OT network architecture, industrial protocols, and the Purdue model.
• Strong written and verbal communication skills, with experience coaching analysts and creating clear technical documentation.

Preferred Qualifications

• Experience supporting an electric utility or other critical infrastructure environment, including familiarity with applicable regulatory requirements.
• Working knowledge of IEC 62443.
• Experience integrating Nozomi Networks or another OT monitoring platform with Splunk.
• Experience with risk‑based alerting, security orchestration, automation and response, or detection‑as‑code practices.
• Prior consulting or embedded advisory experience.

Certifications

• Splunk Core Certified Power User or Admin, Splunk Enterprise Security Certified Admin, GICSP, GCIA, GCDA, GCIH, CISSP, or equivalent certifications are helpful. Certifications support, but do not replace, hands‑on SOC and OT experience.

Tools and Technologies:

• Splunk Enterprise and Splunk Enterprise Security
• Search Processing Language (SPL)
• Correlation searches and notable event workflows
• Nozomi Networks or another OT monitoring platform
• MITRE ATT&CK and ATT&CK for IC S
• IEC 62443
• OT log sources, parsing, normalization, field extraction, and enrichment

MatchPoint Solutions provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation, and training