Senior OT Security Analyst

Accountabilities:

• • Lead frontline shift operations, guiding analysts as they triage alerts and network telemetry across customer OT environments and stepping into regional shift-lead responsibilities when required.
  • Conduct senior-level investigations into suspicious activity, identifying network anomalies, configuration issues, and potential malicious behavior within industrial environments.
  • Analyze and escalate findings to incident responders and threat hunters with clear, detailed, and actionable documentation that supports effective investigation and response.
  • Collaborate across cybersecurity teams, including analysts, threat hunters, incident responders, platform engineers, and Detection Engineering, to improve detection logic, reduce false positives, and develop new detections and playbooks.
  • Prepare incident summaries and operational reports that clearly communicate security findings, trends, and environmental activity to internal stakeholders and customers.
  • Support the broader OT security service, including asset classification, vulnerability management, hardening recommendations, customer information requests, and ongoing platform operations.
  • Mentor and support junior analysts, sharing investigative techniques, operational knowledge, and best practices for OT security monitoring.
  • Continuously develop industrial security expertise, staying current with ICS/OT protocols, adversary tradecraft, threat intelligence, and emerging techniques relevant to industrial environments.

  Requirements:

  • 3–5 years of experience in network security, ideally including hands-on experience investigating real-world threats and suspicious network activity.
  • Strong understanding of core networking concepts, including TCP/IP, firewalls, DNS, and packet analysis.
  • Hands-on experience with security monitoring technologies, such as IDS/IPS, SIEM platforms, network traffic analysis tools, or comparable security operations technologies.
  • Strong written and verbal communication skills, with excellent attention to detail and the ability to translate technical findings for both cybersecurity professionals and customers.
  • Genuine interest in ICS/OT cybersecurity and critical infrastructure protection, combined with the ability to quickly understand complex industrial environments.
  • Ability to work independently in a remote environment while coordinating effectively with distributed, cross-functional teams.
  • Willingness to participate in shift-based coverage, weekend, and on-call responsibilities as required.
  • Initial schedule is Monday–Friday, 8:00 a.m.–5:00 p.m., with weekend on-call coverage. The schedule is expected to transition to a four-day, 10-hour shift model, with employees choosing either Sunday–Wednesday or Wednesday–Saturday.
  • Experience working within a Security Operations Center (SOC) is preferred.
  • Familiarity with OT/ICS protocols such as Modbus, DNP3, and EtherNet/IP is preferred.
  • Applied knowledge of OT-relevant adversary tactics and frameworks, including MITRE ATT&CK for ICS, is a plus.
  • Hands-on laboratory, internship, threat hunting, digital forensics, or cybersecurity operations experience is valued.
  • Experience with PCAP analysis or basic scripting using Python, Bash, or similar tools is a plus.

  Benefits:

  • AUD 130,000 annual salary according to the source posting.
  • Competitive equity package.
  • Comprehensive benefits plan.
  • Remote-first work environment.
  • Opportunity to work directly on OT and industrial cybersecurity, protecting environments that support critical infrastructure.
  • Exposure to threat detection, incident response, threat hunting, vulnerability management, and OT security operations.
  • Collaboration with experienced cybersecurity professionals across distributed global teams.
  • Opportunities to develop specialized expertise in ICS/OT protocols, industrial threat intelligence, and adversary tradecraft.
  • Structured shift options following the transition to the four-day schedule, with either Sunday–Wednesday or Wednesday–Saturday coverage.