OT Threat Hunter (Mumbai)

Title: OT Threat Hunter & Detection

Location: Mumbai / Bangalore

Exp: 8-16 Yrs

Job Description:

Key Responsibilities

• OT Threat Hunting
• Conduct proactive threat hunting across OT and ICS environments.
• Develop threat-hunting hypotheses based on threat intelligence, attack techniques, asset criticality and known vulnerabilities.
• Identify unauthorised assets, abnormal communications, unusual access patterns, protocol misuse and suspicious lateral movement.
• Investigate activity affecting HMIs, engineering workstations, historians, domain infrastructure, remote-access systems and industrial network zones.
• Analyse packet captures, network flows, authentication logs, firewall logs, endpoint telemetry and OT security-monitoring data.
• Identify indicators of compromise and suspicious behaviour associated with industrial threat actors.
• Map findings to MITRE Telecommunication&CK; for ICS and MITRE Telecommunication&CK; Enterprise where applicable. Detection Engineering.
• Develop and validate OT-specific detection use cases and analytics.
• Create investigation procedures, hunting queries, alert-triage guides and response playbooks.
• Review existing OT monitoring coverage and identify detection gaps.
• Tune security alerts to improve detection quality and reduce unnecessary false positives.
• Establish baseline communication patterns for critical industrial assets and network zones.
• Develop detection logic for: o Unauthorised asset connections o Unexpected protocol usage o Current or abnormal communication paths o Suspicious remote access o Credential misuse o Lateral movement o Engineering-workstation anomalies o Changes to PLC or controller communication
• Support purple-team exercises by validating whether simulated attack activity is detected and investigated effectively. Alert Investigation and Incident Support
• Analyse and triage alerts generated by OT IDS, NDR, SIEM and endpoint-security platforms.
• Correlate alerts across IT and OT systems to identif .