OT Threat Intelligence Lead for ICS/SCADA & Space OT

Mitre Corporation; Huntsville (AL); On-site; USD 173,000 - 259,000; Full time

Job summary

MITRE Corporation seeks an Operational Technology (OT) Cyber Threat Intelligence Lead to bridge deep OT threat intel and automated adversary emulation. Analyze real-world ICS/OT threats to distill operational behaviors, patterns, and protocol mechanics for automated OT emulation in Caldera.

Role requires 2+ years OT experience, strong knowledge of industrial protocols, and a Top Secret clearance. On-site work is required; collaboration with government sponsors and industry partners is essential.

Qualifications

• 10 years of related experience with a bachelor’s degree; 8 years with a master’s; or PhD with 5 years’ experience.
• Degree in Computer Science, Cybersecurity, Information Systems, Intelligence Studies or related field.
• Direct OT environment experience min 2 years in OT/ICS/Space OT.
• Industrial protocols familiarity: Modbus TCP, DNP3, OPC UA/DA, Ethernet/IP.
• ATT&CK for ICS / SPARTA / Cyber Kill Chain familiarity.
• Active Top Secret clearance (Top Secret/SCI preferred) and U.S. citizenship.
• On-site work required (min 3 days/week).

Responsibilities

• Adversary behavior deconstruction: analyze ICS/OT threat intel to identify behaviors and network patterns.
• Translate OT threat intel into technical requirements for emulation capabilities (Caldera for OT).
• OT threat tracking on APTs targeting critical infrastructure and space OT environments.
• Sponsor program guidance for OT threat intel programs and defense strategies.
• OT risk modeling and cyber-physical risk assessments using ATT&CK for ICS / SPARTA.
• Produce technical briefs and attack flow mappings for engineering and leadership.

Skills

OT threat intel

ICS/OT security

Threat modeling

Adversary emulation

Caldera usage

Education

Bachelor in Computer Science or Cybersecurity

Master's or PhD in a related field

Tools

Caldera

Modbus TCP

DNP3

OPC UA/DA

Ethernet/IP

Job description

MITRE Corporation seeks an Operational Technology (OT) Cyber Threat Intelligence Lead to bridge deep OT threat intel and automated adversary emulation. Analyze real-world ICS/OT threats to distill operational behaviors, patterns, and protocol mechanics for automated OT emulation in Caldera.

Role requires 2+ years OT experience, strong knowledge of industrial protocols, and a Top Secret clearance. On-site work is required; collaboration with government sponsors and industry partners is essential.