OT SECURITY ANALYST D/F/M

• Location(s):
• London, City of London, GB, EC2R 8HP
• Great Yarmouth, NFK, GB, NR30 3PY
• Ibbenbüren, NW, DE, 49479
• Hamm, NW, DE, 59071
• Köln, NW, DE, 50935
• Heimbach, NW, DE, 52396
• Herdecke, NW, DE, 58313
• Dortmund, NW, DE, 44139
• Lingen, NI, DE, 49808
• Ferrybridge, WKF, GB, WF11 8NG
• Cowes, IOW, GB, PO32 6JS
• Markinch, FIF, GB, KY7 6GU
• Dormagen, NW, DE, 41538
• Eemshaven, GR, NL, 9970 XN
• Perth, PKN, GB, PH1 1RA
• Biblis, HE, DE, 68647
• Maasbracht, LI, NL, 6051 JP
• Dolgarrog, CWY, GB, LL32 8QE
• Bernkastel-Kues, RP, DE, 54470
• Jüchen, NW, DE, 41363
• Grimsby, LIN, GB, DN31 3SY
• Didcot, OXF, GB, OX11 7YU
• Little Barford, CAM, GB, PE19 6YT
• King’s Lynn, NFK, GB, PE34 3RD
• Dresden, SN, DE, 01129
• Moerdijk, Noord Brabant, NL, 4782 PM
• Cheshire, Cheshire, GB, CH65 1AF
• Utrecht, UT, NL, 3521 AZ
• Swindon, Wiltshire, GB, SN5 6PB
• Inverness, HLD, GB, IV2 3BW
• Jülich, NW, DE, 52428
• Hythe, HAM, GB, SO45 3BP
• Hamburg, HH, DE, 20354
• Ludwigshafen, RP, DE, 67063
• Bergheim, NW, DE, 50129
• Werne, NW, DE, 59368
• Duisburg, NW, DE, 47259
• Marl, NW, DE, 45770
• Pembroke, Pembrokeshire, GB, SA71 5SS
• Staythorpe, NTT, GB, NG23 5PS
• Geertruidenberg, Noord Brabant, NL, 4931 NC
• Gelsenkirchen, NW, DE, 45881
• Laufenburg, BW, DE, 79725
• Essen, NW, DE, 45141

Join our Operational Technology (OT) Security Services team and play a key role in monitoring, analysing and responding to security threats and incidents. You will also help improve our detection capabilities and knowledge base, protecting the Operational Technology environments that are critical for RWE Generation’s flexible power generation and hydrogen (H₂) production.
We are an international, hybrid team across Germany, the Netherlands and the UK, working with transparency, respect, collaboration and a healthy sense of fun. At the heart of our work is the OT Security Operations Center (OT SOC), where we provide network monitoring, threat and vulnerability management, asset and configuration support, as well as security assessments, system hardening and red/purple team activities.

Your tasks in this role:

• Monitor and analyse security events and alerts using SIEM, NSM and related tools.
• Respond to incidents in real time, from containment and recovery to reporting and follow-up.
• Develop and maintain detection use cases and incident response playbooks for OT/ICS threats.
• Assess and improve visibility by identifying and closing monitoring and logging gaps.
• Investigate incidents thoroughly, performing root cause analysis and sharing lessons learned.
• Document clearly and consistently all findings, incidents and improvements.
• Contribute to continuous improvement of processes, tooling, documentation, audits and knowledge sharing.

This role includes on-call duties and occasional travel to sites and team meetings in Germany, the Netherlands, the UK and Turkey.