{"id":1963451,"url":"https://alion.io/job/chenega-ot-ics-soc-analyst","title":"OT / ICS SOC Analyst","company":{"id":2131546,"name":"Chenega","domain":"chenega.com","url":"https://alion.io/company/chenega","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Redstone Arsenal, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":71000,"max_usd":147000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":325},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Machine Learning","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Tcpdump","optional":true},{"name":"Triton","optional":true},{"name":"Wireshark","optional":true}],"status":"live","first_seen_at":"2026-10-06T16:32:03Z","employer_posted_date":"2026-10-06","last_verified_at":"2026-10-20T23:31:28Z","board_verified":true,"closed_at":null,"days_open":14,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":14},"description":"Overview\nOT/ICS SOC Analyst\nHuntsville, Alabama\nAre you ready to enhance your skills and build your career in a rapidly evolving business climate? Are you looking for a career where professional development is embedded in your employer’s core culture? If so, Chenega Military, Intelligence & Operations Support (MIOS) could be the place for you! Join our team of professionals who support large-scale government operations by leveraging cutting-edge technology and take your career to the next level!\nChronos Operations (CO) is a wholly-owned subsidiary of Chenega Corporation, an Alaska Native Corporation based in Anchorage, AK. Belonging to the Military, Intelligence, and Operations Support (MIOS) Strategic Business Unit (SBU), Chronos has a culture rooted in integrity, respect, and exceptional performance. Chronos is headquartered in Colorado Springs, CO, and provides mission-critical services in Advanced Analytics & AI, Software Engineering, Cybersecurity, Information Technology, and Intelligence.\nWe deliver essential cyber services to our customers in support of their missions to sustain the national security and economic interests of our nation.\nThe OT / ICS SOC Analyst performs advanced monitoring, threat hunting, anomaly investigation, incident response coordination, and threat analysis across converged IT/OT environments, Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA) platforms, Distributed Control Systems (DCS), and mission support networks.\nOperating with increased autonomy within established operational authorities and rules of engagement, the analyst correlates telemetry across the Purdue Model (Levels 1-3+), evaluates physical process anomalies alongside digital indicators, ensures response measures prioritize personnel safety and process reliability, and continuously improves OT-specific detection mechanisms, playbooks, and defensive readiness.\nResponsibilities\nMonitor and analyze security telemetry across network, endpoint, identity, cloud, application, email, and other enterprise sources using approved SIEM, XDR, NDR, and security analytics platforms.\nInvestigate escalated or complex cybersecurity events to determine validity, scope, affected assets and identities, potential mission impact, and required response actions.\nCorrelate alerts with asset criticality, vulnerability information, threat intelligence, user behavior, and historical activity to develop evidence-based analytical conclusions.\nLead or perform incident triage and analysis; collect, preserve, and document relevant evidence in accordance with established procedures and evidence-handling requirements.\nExecute authorized containment and response actions, including host isolation, account restriction, indicator blocking, or other approved measures, and coordinate eradication and recovery activities with responsible stakeholders.\nDevelop clear incident records, analytical findings, timelines, and technical reports; communicate status, risk, and recommended actions to SOC leadership and mission stakeholders.\nApply threat intelligence, indicators of compromise, adversary tactics, techniques, and procedures, and frameworks such as MITRE ATT&CK to identify related activity and support defensive recommendations.\nReview and validate findings, recommendations, and summaries generated by automated analytics, machine learning, or AI-enabled cybersecurity capabilities before operational use.\nTune alerts and detection logic, recommend telemetry improvements, and help reduce false positives, coverage gaps, and analyst workload in coordination with detection engineering or platform owners.\nDevelop, test, maintain, and improve incident response playbooks, standard operating procedures, queries, dashboards, and repeatable analytical workflows.\nParticipate in or facilitate post-incident reviews and lessons-learned activities; translate findings into corrective actions and measurable operational improvements.\nMentor SOC Analyst I personnel, provide quality reviews of escalated cases, and share technical knowledge across shifts and teams.\nSupport cyber exercises, readiness assessments, recovery validation, and continuous improvement activities as directed by the SOC Lead.\nPerform additional duties as assigned.\nQualifications\nBachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Technology, Software Engineering, Data Science, or a related field and 3+ years of relevant experience.\nOr applicants may meet one of the following substitutions:Associate's degree and 5+ years of relevant experience.\nHigh school diploma or GED equivalent and 7+ years of relevant experience.\nRelevant experience must include cybersecurity operations, security monitoring, network defense, incident response, threat analysis, system administration, or a closely related information technology discipline. At least 2+ years must involve SOC, cyber defense, or incident response functions.\n\nActive DOD IAT Level II Certification or higher is required. \nActive Secret clearance with the ability to obtain and maintain TS/SCI eligibility.\nPreferred Qualifications:\nActive TS/SCI clearance.\n5+ or more years of relevant cybersecurity experience, including 2+ or more years in a SOC, cyber defense, or incident response environment.\nExperience investigating endpoint, network, identity, cloud, email, or application security events using SIEM, EDR/XDR, NDR, SOAR, vulnerability management, or threat intelligence platforms.\nOT/ICS Security Tooling: Hands-on operational experience with leading OT security and asset inventory platforms such as Dragos Platform, Claroty Continuous Threat Detection (CTD), Nozomi Networks Guardian, Tenable OT (Indegy), or ForeScout eyeInspect.\nWorking familiarity with programmable logic controllers (PLCs), remote terminal units (RTUs), human-machine interfaces (HMIs), distributed control systems (DCS), and safety instrumented systems (SIS) manufactured by vendors such as Rockwell Automation/Allen-Bradley, Siemens, Schneider Electric, Emerson, or GE.\nExperience developing or tuning detection logic, analytical queries, dashboards, automation, or incident response playbooks.\nExperience applying MITRE ATT&CK, threat intelligence, and adversary behaviors to investigations and defensive recommendations.\nExperience supporting the Department of Defense, Federal Civilian, Intelligence Community, or critical infrastructure missions.\nRole-Specific Certifications:GIAC Global Industrial Cyber Security Professional (GICSP)\nGIAC Response and Industrial Defense (GRID)\nGIAC Critical Infrastructure Protection (GCIP)\nISA/IEC 62443 Cyber Security Specialist/Expert\nGIAC Certified Incident Handler (GCIH) or CISSP\n\nKnowledge, Skills and Abilities:\nOT/ICS Protocol Analysis: Demonstrated ability to dissect and analyze industrial protocol traffic (Modbus TCP/RTU, DNP3, CIP, Ethernet/IP, OPC, BACnet, PROFINET, S7comm) and identify anomalies such as unauthorized command functions or out-of-spec register writes.\nPurdue Model & Boundary Defense: Advanced understanding of industrial network segmentation, IDMZs, jump hosts, dual-homed servers, unidirectional security gateways (data diodes), and boundary firewall rulebases separating Level 4/5 IT from Level 0-3 OT.\nSafe Operational Response: Strict appreciation of the primacy of safety, physical reliability, and process availability over data confidentiality, understanding that standard IT containment methods (e.g., abrupt host isolation or aggressive vulnerability scanning) can cause equipment trips or physical hazards.\nAdversary Tradecraft in ICS: Knowledge of real-world OT/ICS threat actors, destructive malware families (e.g., Industroyer/CrashOverride, TRITON/Trisis, INCONTROLLER/Pipedream), living-off-the-land techniques in engineering environments, and supply chain threats.\nPacket & Tooling Competency: Advanced proficiency in Wireshark, tcpdump, and specialized dissectors, combined with scripting capabilities (Python, PowerShell, Bash) and query building (KQL, SPL, Lucene).\nInterdisciplinary Collaboration: Proven ability to bridge the cultural and technical gap between cybersecurity teams and operational plant/controls engineers, translating cyber events into operational and physical consequences.\nHow you’ll grow\nAt Chenega MIOS, our professional development plan focuses on helping our team members at every level of their careers to identify and use their strengths to do their best work every day. From entry-level employees to senior leaders, we believe there’s always room to learn.\nWe offer opportunities to help sharpen skills in addition to hands-on experience in the global, fast-changing business world. From on-the-job learning experiences to formal development programs, our professionals have a variety of opportunities to continue to grow throughout their careers.\nBenefits\nAt Chenega MIOS, we know that great people make a great organization. We value our team members and offer them a broad range of benefits.\nLearn more about what working at Chenega MIOS can mean for you.\nChenega MIOS’s culture\nOur positive and supportive culture encourages our team members to do their best work every day. We celebrate individuals by recognizing their uniqueness and offering them the flexibility to make daily choices that can help them be healthy, centered, confident, and aware. We offer well-being programs and continuously look for new ways to maintain a culture where we excel and lead healthy, happy lives.\nCorporate citizenship\nChenega MIOS is led by a purpose to make an impact that matters. This purpose defines who we are and extends to relationships with our clients, our team members, and our communities. We believe that business has the power to inspire and transform. We focus on education, giving, skill-based volunteerism, and leadership to help drive positive social impact in our communities.\nLearn more about Chenega’s impact on the world.\nChenega MIOS News- https://chenegamios.com/news/\nTips from your Talent Acquisition Team\nWe want job seekers exploring opportunities at Chenega MIOS to feel prepared and confident. To help you with your research, we suggest you review the following links:\nChenega MIOS web site - www.chenegamios.com\nGlassdoor - https://www.glassdoor.com/Overview/Working-at-Chenega-MIOS-EI_IE369514.11,23.htm\nLinkedIn - https://www.linkedin.com/company/1472684/\nFacebook - https://www.facebook.com/chenegamios/\n#Chronos Operations, LLC","description_format":"text","description_chars":10464,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"high_school","optional":false},"security_clearance":true,"languages":[]},"benefits":["Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-06T16:32:03Z"}],"visa":[],"liveness":{"score":21,"band":"cold","label":"Long shot","p_open":1,"p_active":0.456,"p_room":0.45,"age_days":13,"expected_fill_days":7,"reasons":["conf:3","velocity","win:tail","comp:junior,brand"],"computed_at":"2026-10-20T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/chenega-ot-ics-soc-analyst","json_url":"https://alion.io/job/chenega-ot-ics-soc-analyst.json","meta":{"generated_at":"2026-10-21T00:44:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1111,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2131546},"rest":"https://alion.io/mcp/rest/get_company?id=2131546"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fchenega-ot-ics-soc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fchenega-ot-ics-soc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fchenega-ot-ics-soc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/chenega-ot-ics-soc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fchenega-ot-ics-soc-analyst"}]}