Rockwell Automation is looking to enhance the security monitoring and threat detection capabilities within its critical OT/ICS environments by implementing and optimizing a Security Information and Event Management (SIEM) system.
Requirements
- 5+ years experience working with SIEM platforms (e.g., Sumo Logic, Palo Alto Cortex XSOAR) and a strong understanding of their architecture, configuration, and rule development.
- Understanding of OT protocols (e.g., Modbus, DNP3, IEC 61850), industrial control systems (e.g., PLC, SCADA, DCS), and their logging mechanisms.
- 2+ years of experience in parsing and normalizing complex log formats, including those specific to OT devices and applications.
- Specific experience integrating OT data sources with enterprise SIEM platforms.
- Knowledge of security frameworks and standards relevant to OT (e.g., NIST SP 800-82, IEC 62443).
- Experience with scripting languages (e.g., Python, PowerShell) for SIEM automation and data manipulation.
- Relevant certifications such as GICSP, GRID, CISSP, or SIEM-specific certifications.
Responsibilities
- Develop SIEM and SOAR solutions tailored for OT environments, considering the unique challenges and protocols involved.
- Integrate multiple OT data sources (e.g., IDS, EDR, control system logs, network traffic from industrial protocols) into the SIEM platform.
- Maintain custom parsers, normalizers, and correlation rules to effectively analyze OT-specific logs and events within the SIEM.
- Configure and improve the SIEM platform for performance, scalability, and stability in an OT context.
- Maintain OT-focused dashboards and reports within the SIEM to provide applicable insights into security posture and potential threats.
- Tune and improve SIEM rules and alerts to minimize false positives and ensure high-fidelity detection of OT security incidents.
- Maintain documentation for the OT SIEM architecture, data sources, rules, and operational procedures.
Other
- Bachelor's degree
- Legal authorization to work in the U.S. We will not sponsor individuals for employment visas, now or in the future, for this job opening.
- Rockwell Automation’s hybrid policy aligns that employees are expected to work at a Rockwell location at least Mondays, Tuesdays, and Thursdays unless they have a business obligation out of the office.
