Security Operation Supervisor (OT Specialization)

The Security Operations Supervisor (OT Specialization) leads the day-to-day work of a team of security operations analysts and serves as the senior technical escalation point for threats affecting both our corporate IT estate and our operational technology environments, including battery energy storage sites and the systems that support them. Based in Bengaluru, this role supervises cybersecurity analysts, quality of triage and investigation, and the professional growth of the analyst team, while personally handling complex detection, hunting and incident response work. The Supervisor partners closely with the global cybersecurity team, IT infrastructure, service desk, service and operations engineering, product security and, where required, customers and external incident response partners. The ideal candidate has hands-on security operations depth, real exposure to industrial control system and OT environments, and a genuine interest in coaching analysts and improving how a security operations team works. Key tools and platforms include Microsoft Sentinel and Defender, endpoint detection and response, SOAR and automation platforms, OT monitoring technologies, threat intelligence services and IT service management tooling.

• Bachelor's degree in computer science, information security, cybersecurity, engineering or a related field, or equivalent practical experience.
• Minimum 6 years of experience in cybersecurity, with at least 4 years in a security operations, incident response or threat detection role.
• Minimum 2 years of experience supervising, leading or mentoring analysts, including shift coordination, quality review and coaching. Formal people management experience is welcome but a strong technical lead background will also be considered.
• Minimum 2 years of hands-on experience with industrial control system or operational technology environments, such as battery energy storage, power generation, utilities or manufacturing.
• Demonstrated experience with SIEM platforms, including writing and tuning detection content and building dashboards and reports. Experience with Microsoft Sentinel and KQL is strongly preferred.
• Practical experience with endpoint detection and response, network detection, identity protection and email security tooling.
• Working knowledge of cloud security concepts and the security capabilities of major cloud platforms such as Azure, AWS and GCP, including detection of cloud-native attack techniques.
• Familiarity with industrial protocols and OT architecture concepts, such as Modbus, DNP3, IEC 61850, OPC and the Purdue model, and the ability to read a basic network or one-line diagram.
• Experience with risk assessment, incident response and security audits.
• Experience with regulatory compliance and information security management frameworks such as ISO 27001, NIST Cybersecurity Framework, NIST SP 800-53 or COBIT.
• Advanced analytical, problem-solving and troubleshooting capabilities, with sound judgment under time pressure.
• Strong written and verbal communication skills in English, with the ability to write clear incident reports and explain technical risk to non-technical stakeholders.
• Willingness to participate in an on-call rotation and to support incidents outside standard business hours when required.
• Master's degree in cybersecurity, information security or a related technical field.
• OT or ICS security certification such as GICSP, GRID or GCIP.
• Security operations or incident response certification such as GCIA, GCIH, GCFA or Microsoft SC-200.
• Management or governance certification such as CISSP, CISM or CISA.
• Experience with OT monitoring and asset visibility platforms such as Dragos, Claroty, Nozomi or Tenable OT.
• Experience building SOAR automation, for example with Logic Apps, and scripting in PowerShell or Python.
• Familiarity with DevOps security practices and the ability to integrate security checks into a DevOps pipeline.
• Experience supporting a follow-the-sun or globally distributed security operations model.
• Digital forensics or malware analysis experience.
• Exposure to the energy storage, renewable energy or utility sector, and to customer-facing security obligations in service agreements.
• Team leadership and analyst development, including coaching, feedback and workload management.
• Threat detection and incident response judgment, with strong decision-making that weighs the relative costs and benefits of possible actions and selects the most appropriate one.
• OT and safety awareness, understanding where availability and physical process safety constrain security actions.
• Technical breadth across firewalls, intrusion detection and prevention systems, SIEM, SOAR, endpoint and identity security tooling.
• Influence and stakeholder management, with the ability to shift the opinions, plans or behavior of teams outside direct authority.
• Process discipline and continuous improvement, turning incidents and metrics into lasting change.
• Business alignment, consistently applying an understanding of organizational mission, values and goals to security decisions.