{"id":937886,"url":"https://alion.io/job/gruve-ot-soc-analyst-l2","title":"OT SOC Analyst L2","company":{"id":673112,"name":"Gruve","domain":"gruve.ai","url":"https://alion.io/company/gruve","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":80,"open_postings":12,"ghost_share":0,"stale_share":0.75,"repost_share":0.083,"time_to_fill_p50_days":25,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Pune, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":12500,"max_usd":31000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":854},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"DNP3","optional":false},{"name":"IBM QRadar","optional":false},{"name":"OPC UA","optional":false},{"name":"PowerShell","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Windows","optional":false},{"name":"Wireshark","optional":false}],"status":"live","first_seen_at":"2026-07-17T10:26:15Z","employer_posted_date":"2026-09-30","last_verified_at":"2026-10-26T09:09:39Z","board_verified":true,"closed_at":null,"days_open":100,"trust":{"level":"stale","repost_count":1,"flags":["stale"],"days_open":100},"description":"About Gruve\nGruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.\nPosition summary:\nWe are seeking a skilled OT SOC Analyst L2 to join our OT Security Operations Center. The ideal candidate will have 3 - 6 years of experience in OT/ICS cybersecurity monitoring and incident investigation, with hands-on exposure to industrial environments such as ICS, SCADA, PLC, RTU, and HMI ecosystems. The analyst will act as the primary escalation point from L1, perform advanced monitoring and triage, support Nozomi and SIEM operations, assist integrations and deployments, and deliver high-quality customer support and reporting while safeguarding safety-critical industrial operations.\nKey Roles & Responsibilities:\n1. Security Monitoring and Incident Triage\nMonitor OT and IT security alerts across SIEM and OT visibility platforms such as Splunk, QRadar, Sentinel, FortiSIEM, Elastic, and Nozomi Guardian.\nValidate suspicious activities, correlate security events, monitor industrial communications, and track abnormal asset behavior in ICS/SCADA environments.\nEscalate confirmed incidents with complete evidence, business impact, and recommended next actions.\n2. Incident Investigation and Analysis\nInvestigate OT security alerts, malware indicators, unauthorized changes, policy violations, and suspicious network behavior affecting PLCs, RTUs, HMIs, historians, and engineering workstations.\nPerform packet analysis using Wireshark, validate indicators of compromise, identify lateral movement, and support containment and recovery activities under defined runbooks.\n3.SIEM, Nozomi, and Detection Administration\nSupport SIEM administration activities including log source validation, parser verification, dashboard usage, alert tuning, and false-positive reduction.\nAssist in the administration and health monitoring of OT security monitoring platforms such as Nozomi Guardian and related collectors/sensors.\nContribute to the creation and maintenance of detection rules and OT use cases aligned to industrial threats and operational realities.\n4.Deployment and Integration Support\nAssist OT solution deployments by validating sensor connectivity, syslog forwarding, collector health, API integrations, use-case testing, and user acceptance activities.\nSupport integration of OT monitoring platforms with SIEM, SOAR, ticketing systems, and reporting workflows.\n5. OT Log, Asset, and Protocol Analysis\nReview logs, alarms, and network telemetry from OT and IT sources to identify anomalies and confirm incident context.\nDemonstrate working knowledge of industrial protocols including Modbus, DNP3, OPC UA, IEC 60870-5-104, PROFINET, and related industrial Ethernet communications.\nSupport OT asset inventory validation, communication baseline analysis, and visibility improvement activities.\n6. Customer Support and Troubleshooting\nProvide remote troubleshooting, incident bridge support, health checks, upgrade support, and ticket resolution for customer OT security environments.\nCommunicate effectively with customers, internal stakeholders, and project teams while maintaining SLA commitments.\n7. Reporting and Documentation\nPrepare daily SOC reports, weekly incident summaries, asset visibility reports, security posture updates, and SLA-driven ticketing updates.\nMaintain accurate incident records, SOPs, runbooks, troubleshooting notes, and knowledge-base documentation.\n8. Collaboration and Escalation\nWork closely with L1 analysts, L3 engineers, implementation teams, customer stakeholders, and cross-functional security teams to resolve operational issues.\nEscalate complex OT incidents, persistent integration issues, and monitoring gaps to the appropriate engineering or management teams.\n9.Compliance and Best Practices\nFollow established OT security procedures, change controls, and documentation standards while supporting compliance and audit requirements.\nOperate with awareness of plant safety, production availability, maintenance windows, and the sensitivity of safety-critical environments.\n10. Continuous Improvement\nRecommend improvements to alert quality, reporting accuracy, use cases, SOPs, dashboarding, and OT monitoring coverage.\nStay updated on OT cyber threats, industrial attack techniques, and evolving defensive controls relevant to manufacturing, utilities, energy, and other industrial sectors.\n11. Report deviations and concerns to the SOC Manager\nBasic Qualifications:\nBachelor’s degree in computer science, Information Technology, Cybersecurity, Electronics, Instrumentation, or a related field.\n3-6 years of experience in cybersecurity operations, OT SOC, ICS/SCADA monitoring, incident investigation, or industrial network security.\nHands-on exposure to SIEM platforms such as Splunk, QRadar, Sentinel, FortiSIEM, or Elastic, and familiarity with Nozomi Guardian or similar OT monitoring tools.\nWorking knowledge of OT/ICS environments including ICS, SCADA, PLC, RTU, HMI, historians, industrial switches, and engineering workstations.\nUnderstanding of industrial protocols such as Modbus, DNP3, OPC UA, IEC 60870-5-104, PROFINET, and related traffic analysis concepts.\nExperience with Wireshark, Syslog, Linux, Windows, Excel, and PowerShell for troubleshooting, analysis, and reporting.\nStrong analytical thinking, documentation discipline, customer interaction skills, time management, and team collaboration.\nAbility to work in rotational shifts, manage ticket queues, and operate effectively in high-availability industrial environments.\nPreferred Qualifications:\nCertifications such as Security+, Microsoft SC-200, Splunk Power User, QRadar Analyst, Nozomi Fundamentals, GICSP (foundation level exposure), or equivalent.\nExposure to SOAR workflows, API-based integrations, threat intelligence enrichment, and OT vulnerability management processes.\nKnowledge of Purdue Model, network segmentation, jump hosts, remote access controls, firewall policy validation, and OT asset inventory concepts.\nExperience supporting industrial customers in sectors such as manufacturing, energy, utilities, oil and gas, pharma, or critical infrastructure.\nStrong interest in building deeper expertise across OT detection engineering, incident response, industrial protocols, and customer-facing delivery.\nWhy Gruve\nAt Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you.\nGruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.","description_format":"text","description_chars":7146,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Managed Security","AI Consulting & Integration"],"lifecycle":[{"event":"open","at":"2026-09-15T15:34:58Z"},{"event":"close","at":"2026-09-21T10:08:59Z"},{"event":"reopen","at":"2026-09-23T08:22:42Z"}],"visa":[],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.275,"p_room":0.28,"age_days":100,"expected_fill_days":25,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:"],"computed_at":"2026-10-26T05:57:25Z"},"pay":null,"html_url":"https://alion.io/job/gruve-ot-soc-analyst-l2","json_url":"https://alion.io/job/gruve-ot-soc-analyst-l2.json","meta":{"generated_at":"2026-10-26T09:17:32Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12460,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":673112},"rest":"https://alion.io/mcp/rest/get_company?id=673112"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgruve-ot-soc-analyst-l2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgruve-ot-soc-analyst-l2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgruve-ot-soc-analyst-l2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/gruve-ot-soc-analyst-l2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgruve-ot-soc-analyst-l2"}]}