OT SOC Analyst II

CenterPoint Energy; Houston (TX); On-site; USD 90,000 - 120,000; Full time

Benefits offered by this job

Competitive pay

Paid training

Benefits from day one

Transit subsidies

Flexible work schedule

On-site wellness center (Houston)

Tuition reimbursement

401(k) matching

Job summary

CenterPoint Energy is seeking an OT SOC Analyst to monitor, detect, analyze, and respond to cybersecurity events impacting OT/ICS environments. You will analyze alerts, triage incidents, and escalate as per playbooks to protect critical infrastructure.

You will collaborate with engineering teams to refine detection logic, support forensics, and document actions while staying current on OT threats and regulatory obligations in the utility sector.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical field is preferred, or equivalent practical experience
• 1-3 years of hands-on SOC experience including alert triage, investigation, and incident escalation in IT and/or OT environment
• Hands-on experience configuring, tuning, and operating SIEM/SOAR platforms in an operational security environment
• Certifications from Splunk and GIAC (e.g., GICSP, GRID, GCIP, GCIA, GCIH) are highly desirable
• Experience with OT/ICS environments and OT threat tools (Nozomi, Dragos, Claroty)
• Strong networking knowledge (TCP/IP, routing, firewalls, OT protocols like Modbus/DNP3)

Responsibilities

• Perform continuous 24/7 monitoring of OT networks, systems, and devices including SCADA, PLCs, RTUs, IEDs
• Analyze alerts, logs and telemetry to identify anomalies and IOCs
• Conduct initial triage and investigate detected events for scope and impact
• Escalate incidents per OT SOC playbooks and escalation procedures
• Collaborate with stakeholders to refine detection logic and OT playbooks
• Document incidents, investigations and actions in ticketing systems

Skills

OT/ICS security

SIEM/SOAR

Incident response

Network analytics

Threat investigation

Education

Bachelors in Cybersecurity/CS/IT

Tools

Splunk

Nozomi

Dragos

Claroty

Job description

CenterPoint Energy and its predecessor companies have been in business for more than 150 years.

Our Vision: Our vision is to become the most admired utility in the United States through the execution of our long-term growth strategy. We have an unwavering commitment to safely and reliably deliver electricity and natural gas to millions of people.

Our Commitment: CenterPoint Energy is committed to creating an inclusive work environment where business results are achieved through the skills, abilities and talents of our diverse workforce.

At CenterPoint Energy, individuals are respected for their contributions toward our company objectives. We strive for an inclusive work environment across all levels that is reflective of the available workforce in the communities we serve.

Job Summary

The OT SOC Analyst is responsible for monitoring, detecting, analyzing, and responding to cybersecurity events impacting Operational Technology (OT) and Industrial Control System (ICS) environments. This role performs advanced analysis of alerts and events generated by OT security monitoring platforms and SIEM/SOAR technologies, conducts investigations into suspicious activity, and escalates confirmed or potential incidents in accordance with established OT SOC playbooks and procedures.

The analyst will work closely with key stakeholders to protect critical infrastructure, maintain real-time visibility into OT network activity, and support the safety, reliability and continuity of operational systems.

Essential Functions

• Perform continuous (24/7) monitoring of OT networks, systems, and devices, including SCADA systems, PLCs, RTUs, IEDs, and associated communications infrastructure.
• Analyze alerts, logs, and telemetry from OT security platforms and SIEM/SOAR solutions to identify anomalies, indicators of compromise (IOCs), and potential cyber threats.
• Conduct initial triage and investigation of detected events, determining scope, severity, and potential operational impact.
• Escalate confirmed or suspected incidents in accordance with OT SOC playbooks, incident classification criteria, and escalation procedures.
• Perform in-depth analysis of suspicious activity within OT environments, including log review, network traffic analysis, and correlation across multiple data sources.
• Support forensic analysis of impacted OT systems to assist in identifying root causes, attack paths, and contributing factors.
• Accurately document incidents, investigations, and response actions within organizational ticketing and case management systems.
• Provide timely notification of identified cybersecurity incidents or attempted compromises to appropriate stakeholders.
• Collaborate with OT SOC leadership and engineering teams to refine detection logic, improve SIEM/SOAR use cases, and enhance OT-specific playbooks.
• Participate in incident response activities, including coordination with operations, engineering, compliance, and external partners as required.
• Maintain awareness of emerging OT threats, vulnerabilities, and attack techniques relevant to electric utilities.

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical field is preferred, or equivalent practical experience

Experience

• 1-3 years of hands-on Security Operations Center (SOC) experience, including alert triage, investigation, and incident escalation in an IT and/or OT environment.
• Experience supporting OT cybersecurity or security operations within regulated critical infrastructure environments is highly desirable.
• Hands-on experience configuring, tuning, and operating SIEM/SOAR platforms in an operational security environment.
• Relevant certifications from Splunk and GIAC including GICSP, GRID, GCIP, GCIA or GCIH are highly desirable.
• Demonstrated, hands-on experience with SIEM and SOAR platforms, preferably Splunk, including data correlation, workflow automation and dashboard creation.
• Experience supporting OT or ICS environments is strongly preferred, including exposure to SCADA, PLCs, RTUs, or related systems. Experience working with OT passive monitoring and threat detection tools, such as Nozomi, Dragos, and Claroty.
• Solid understanding of networking fundamentals, including TCP/IP, routing, firewalls, network segmentation, and common OT protocols such as Modbus and DNP3.
• Ability to analyze logs, network flows, and alerts to identify security-relevant events, and apply incident response principles, investigation techniques, and evidence handling practices.
• Familiarity with NERC CIP and TSA cybersecurity requirements and how security monitoring and incident response support regulatory obligations within OT environments.
• Strong analytical and communication skills, with attention to detail and the ability to clearly document findings and collaborate across technical and non-technical teams.

We want you to know

Being a part of the CenterPoint Energy team is more than a career alone. It''s an opportunity to make a positive impact. You will be an integral part of enabling everyday life and the pursuit of possibilities for the customers we serve and the communities we share. The vital services we provide are at the core of making our world work, and by sharing your energy with us, we''ll create a better tomorrow together.

What we bring to you

• Competitive pay
• Paid training
• Benefits eligibility begins on your first day
• Transit subsidies
• Flexible work schedule, paid holidays and paid time off
• Access to discounts at fitness clubs and an on-site wellness center at our headquarters in Houston
• Professional growth and development programs including tuition reimbursement
• 401(k) Savings Plan featuring a company match dollar-for-dollar up to 6% and a company contribution of 3% regardless of your contribution

Job Type: Full Time
Posting Start Date: 07/16/2026
Posting End Date: 07/31/2026

This contractor and subcontractor shall abide by the requirements of 41 CFR 60-1.4(a), 60-300.5(a), and 60-741.5(a). These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities and prohibit discrimination against all individuals based on their race, color, religion, sex, sexual orientation, gender identity, or national origin. Moreover, these regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status or disability.

#LI-CNP