OT Security Consultant (Splunk) for SOC Detection

MatchPoint; Houston (TX); On-site; USD 110,000 - 117,000; Full time

Job summary

MatchPoint is seeking an OT Security Consultant (Splunk) in Houston to lead detection engineering for our SOC. The role requires hands-on Splunk work, OT/ICS security expertise, and collaboration with Nozomi for alert normalization across OT data sources.

You will design SPL searches, optimize detection content, coach analysts, and produce runbooks with clear justification for every change. Expect strong interaction with customer teams and partners in a fast-growing IT security environment.

Qualifications

• Significant hands-on cybersecurity experience in production SOC environments.
• Experience with OT/ICS security monitoring in critical infrastructure contexts.
• Advanced Splunk skills: SPL development, correlation searches, tuning.
• Familiarity with MITRE ATT&CK and ATT&CK for ICS security.
• Understanding OT architectures, Purdue model, and industrial protocols.
• Strong ability to document procedures and coach analysts.

Responsibilities

• Catalogue existing Splunk searches, dashboards, and use cases and identify gaps.
• Co-author a prioritized roadmap with Nozomi lead during initial phase.
• Design and refine SPL correlations and detection content for OT data sources.
• Adjust thresholds and suppression logic to reduce false positives and track impact.
• Review OT log sources and enrichment to ensure reliable detections.
• Collaborate with Nozomi lead to normalize alerts and asset data in Splunk.
• Coach SOC analysts using investigations and OT/IT pivots.
• Create runbooks and tuning rationales for new use cases and training.
• Provide monthly reporting on changes, alert volume, false positives, and coverage.

Skills

Cybersecurity experience

SOC operations

OT/ICS security

Splunk SPL

Detection engineering

ATT&CK awareness

OT network security

Tools

Splunk Enterprise

Nozomi Networks

IEC 62443

Job description

MatchPoint is seeking an OT Security Consultant (Splunk) in Houston to lead detection engineering for our SOC. The role requires hands-on Splunk work, OT/ICS security expertise, and collaboration with Nozomi for alert normalization across OT data sources.

You will design SPL searches, optimize detection content, coach analysts, and produce runbooks with clear justification for every change. Expect strong interaction with customer teams and partners in a fast-growing IT security environment.