OT Security Consultant (Splunk)

MatchPoint is a fast-growing, young, energetic global IT-Engineering services company with clients across the US. We provide technology solutions to various clients like Uber, Robinhood, Netflix, Airbnb, Google, Sephora and more! More recently, we have expanded to working internationally in Canada, China, Ireland, UK, Brazil and India. Through our culture of innovation, we inspire, build, and deliver business results, from idea to outcome. We keep our clients on the cutting edge of the latest technologies and provide solutions by using industry specific best practices and expertise.

We are excited to be continuously expanding our team. If you are interested in this position, please send over your updated resume. We look forward to hearing from you!

Job Description

Job : OT Security Consultant (Splunk)

Location : Houston, TX - onsite

Duration : 12 Months

Rate : $80 to $85 per hour

Operational Technology (OT) Cybersecurity Consultant to lead Splunk detection engineering for a customer Security Operations Center (SOC). This hands-on role requires production SOC experience, an understanding of how OT environments differ from traditional IT, and advanced Splunk expertise. The consultant will evaluate current use cases, improve correlation and alert quality, develop new detection content, coach analysts, and create clear documentation that enables the team to sustain the work independently.

Responsibilities:

• Catalogue and assess existing Splunk correlation searches, dashboards, and use cases against an agreed baseline, identifying coverage gaps and noisy rules.
• Co-author a prioritized roadmap with the Nozomi lead during the initial phase of the engagement.
• Design, test, and refine Search Processing Language (SPL) correlation searches, notable event logic, and detection content tailored to OT data sources.
• Recommend and implement approved adjustments to thresholds and suppression logic to reduce false positives, and track the impact of each change.
• Review OT log sources, parsing, normalization, field extraction, and enrichment so detections are based on reliable data.
• Partner with the Nozomi lead to normalize, enrich, and correlate Nozomi alerts and asset data in Splunk.
• Coach SOC analysts using real investigations and teach effective pivots across OT and IT data.
• Create a runbook and tuning rationale for each new or materially changed use case, and teach analysts to build and tune searches independently.
• Provide monthly reporting on changes, rationale, alert volume, false positive rate, and coverage improvement.
• Coordinate with customer teams, implementation partners, change control, and related Splunk workstreams so improvements are delivered smoothly. Qualifications:

Required Qualifications

• Significant cybersecurity experience, including hands-on SOC work involving triage, investigation, and detection engineering in a production environment; approximately five or more years of overall experience is preferred.
• Experience with OT or Industrial Control System (ICS) security monitoring, ideally in utilities, energy, or critical infrastructure.
• Advanced hands-on Splunk skills, including SPL, correlation search development, and tuning in a production SOC environment.
• Practical knowledge of detection engineering methods and MITRE ATT&CK, with working familiarity with ATT&CK for ICS.
• Understanding of OT network architecture, industrial protocols, and the Purdue model.
• Strong written and verbal communication skills, with experience coaching analysts and creating clear technical documentation.

Preferred Qualifications

• Experience supporting an electric utility or other critical infrastructure environment, including familiarity with applicable regulatory requirements.
• Working knowledge of IEC 62443.
• Experience integrating Nozomi Networks or another OT monitoring platform with Splunk.
• Experience with risk-based alerting, security orchestration, automation and response, or detection-as-code practices.
• Prior consulting or embedded advisory experience.

Certifications

• Splunk Core Certified Power User or Admin, Splunk Enterprise Security Certified Admin, GICSP, GCIA, GCDA, GCIH, CISSP, or equivalent certifications are helpful. Certifications support, but do not replace, hands-on SOC and OT experience.

Tools and Technologies:

• Splunk Enterprise and Splunk Enterprise Security
• Search Processing Language (SPL)
• Correlation searches and notable event workflows
• Nozomi Networks or another OT monitoring platform
• MITRE ATT&CK and ATT&CK for ICS
• IEC 62443
• OT log sources, parsing, normalization, field extraction, and enrichment

MatchPoint Solutions provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation, and training