Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.
We are seeking an experienced OT Security Engineer L3 to lead the design, deployment, integration, support, and optimization of OT security monitoring solutions across ICS, SCADA, DCS, and IIoT environments. The ideal candidate will bring 6–10 years of experience in OT cybersecurity and industrial network defense, act as the highest technical escalation point within the OT SOC, and drive implementation, threat hunting, incident response, detection engineering, customer engagement, and continuous improvement for complex industrial environments.
OT Security Architecture, Deployment, and Implementation

Lead the deployment and configuration of OT monitoring solutions including Nozomi Guardian and related collectors, sensors, packet brokers, TAPs, SPAN ports, and syslog infrastructure.
Design OT monitoring architecture for industrial environments covering asset visibility, protocol decoding, segmentation-aware telemetry collection, and secure integration patterns.
Install and configure SIEM platforms such as Splunk, IBM QRadar, Microsoft Sentinel, FortiSIEM, and Elastic Security for OT use cases.
~ Integrate OT monitoring technologies with SIEM, SOAR, EDR, threat intelligence platforms, CMDBs, ticketing systems, and reporting solutions.
Configure Syslog, REST APIs, STIX/TAXII feeds, automation workflows, and custom integrations for OT firewalls, switches, historians, HMIs, PLCs, and engineering workstations.
~ Lead the investigation of high-severity OT security incidents and act as the final escalation point for complex issues raised by L1 and L2 analysts.
Coordinate containment, eradication, recovery, root-cause analysis, and technical communication with customer incident response teams and internal stakeholders.
~ Perform proactive threat hunting across OT and converged OT/IT environments to identify abnormal asset behavior, unsafe protocol usage, lateral movement, persistence mechanisms, and industrial attack techniques.
Security Monitoring, Packet Analysis, and Forensics

Review OT alerts and correlate them with enterprise SIEM telemetry, asset context, and industrial communication patterns.
Perform advanced packet analysis using Wireshark, support forensic triage, validate malware indicators, and guide evidence collection for OT investigations.
~ Lead onsite and remote implementation activities, conduct customer workshops, deliver technical presentations, and provide expert troubleshooting during upgrades, migrations, and health checks.
Serve as the senior technical SME for OT SOC operations and provide strategic guidance during architecture reviews, escalations, and service improvement planning.
~ Create custom parsers, integrations, playbooks, SOPs, and knowledge artifacts that improve OT visibility, response consistency, and service quality.
Optimize detection logic, data onboarding, alert tuning, and reporting workflows to improve MTTR, response quality, and customer outcomes.
~ OT Domain, Protocol, and Asset Expertise

Apply deep working knowledge of OT/ICS components including ICS, SCADA, DCS, PLC, RTU, HMI, historians, engineering workstations, industrial Ethernet, and IIoT-connected assets.
Produce executive dashboards, weekly and monthly SOC reports, compliance reporting, threat intelligence summaries, deployment status updates, and detailed root-cause analyses.
Maintain high-quality technical documentation for deployments, incidents, integrations, customer environments, and engineering changes.
~ Compliance, Risk, and Assessments

Support OT cybersecurity assessments, vulnerability management activities, and control validation aligned to standards such as ISA/IEC 62443, NIST CSF, and customer-specific governance requirements.
Ensure delivery quality, SLA adherence, audit readiness, and operational alignment with plant safety and production constraints.
~ Mentor L1 and L2 analysts, guide implementation engineers, review technical deliverables, and conduct knowledge transfer sessions for customers and internal teams.
Drive continuous learning around OT attack techniques, threat intelligence, use-case maturity, and industrial cybersecurity best practices.

Bachelor's degree in computer science, Information Technology, Cybersecurity, Electronics, Instrumentation, Industrial Automation, or a related field.
6–10 years of experience in OT cybersecurity, ICS/SCADA security monitoring, industrial network engineering, SOC operations, or related security engineering roles.
Hands-on expertise with OT monitoring and SIEM platforms such as Nozomi Guardian, Splunk, IBM QRadar, Microsoft Sentinel, FortiSIEM, and Elastic Security.
Strong understanding of ICS, SCADA, DCS, PLC, RTU, HMI, historians, engineering workstations, industrial switches, and asset visibility concepts.
Strong OT/industrial networking fundamentals covering TCP/IP, VLANs, routing, switching, firewall policies, VPNs, IDS/IPS, packet capture, and secure remote access.
Experience with Wireshark, Nmap, PowerShell, Linux, Windows Server, REST APIs, troubleshooting, deployment documentation, and RCA preparation.
Certifications such as GICSP, ISA/IEC 62443 Cybersecurity Expert, CISSP, CEH, CompTIA Security+, Nozomi Certified Engineer, Microsoft SC-200, Splunk Certified Consultant, or equivalent.

Experience designing OT visibility architectures, deploying collectors/sensors, validating TAP/SPAN strategies, and integrating packet, log, and asset telemetry.
Exposure to threat intelligence platforms, SOAR orchestration, CMDB/ticketing integrations, custom parser development, and OT-specific detection engineering.
Working knowledge of Purdue Model, zones and conduits, industrial segmentation, change management in plant environments, and maintenance-window-aware deployment practices.
Experience supporting industrial sectors such as manufacturing, energy, utilities, pharma, chemicals, transportation, or other critical infrastructure domains.
We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work.

Security Engineer (Remote)

Start with your email