Cyber OT SecOps

About the Role

The Manager, Cyber OT SecOps is The Coca-Cola Company's operational leader for monitoring, detecting, and responding to cyber threats targeting industrial control systems and manufacturing technology. This role sits within Cybersecurity Operations, ensuring threats to plant floor systems are detected, triaged, investigated, and resolved to protect production, safety, and product quality. Reporting to the Senior Director, Cybersecurity Operations, this individual-contributor position also provides day-to-day operational leadership of the managed security service provider (MSSP) SOC analysts supporting OT environments.

Responsibilities

• OT Security Monitoring & Detection:
  • Own the OT security monitoring and detection capability within the SOC, ensuring visibility into threats targeting ICS, SCADA, HMIs, PLCs, historians, and manufacturing networks.
  • Design, tune, and maintain OT-specific detection rules, alerts, and use cases across platforms like Claroty, Microsoft Defender for IoT, EDR, network monitoring (Palo Alto), and SIEM.
  • Continuously evaluate and improve detection coverage for OT threats, including unauthorized access, network anomalies, and lateral movement between IT and OT environments.
  • Partner with the OT Cybersecurity engineering team to ensure monitoring tools are properly deployed and maintained across manufacturing sites.
• OT Incident Triage & Response:
  • Lead triage, investigation, and response to OT security incidents, ensuring actions account for safety, uptime, and operational continuity.
  • Develop and maintain OT-specific incident response playbooks and escalation procedures.
  • Coordinate with IT SOC, Incident Response, and OT engineering teams during cross-domain incidents.
  • Conduct post-incident reviews and drive improvements in detection, response, and prevention.
• Plant Partnerships & OT Context:
  • Build trusted relationships with plant leadership and teams to understand manufacturing processes and control system architectures.
  • Translate operational knowledge into SOC detection playbooks and triage procedures to reduce false positives.
  • Educate SOC analysts on OT-specific concepts and protocols.
  • Support plant visits to evaluate monitoring effectiveness and identify gaps.
• MSSP SOC Team Leadership:
  • Provide operational direction to MSSP SOC analysts, set priorities, review alert quality, and maintain service-level expectations.
  • Define SOPs, detection playbooks, and training materials for OT environments.
  • Monitor MSSP performance and drive continuous improvement in OT alert handling and triage accuracy.
• Reporting & Continuous Improvement:
  • Provide executive-level reporting on OT security posture, incident trends, and detection coverage.
  • Track and report OT SOC metrics, including alert volume, triage times, and incident outcomes.
  • Continuously improve monitoring capabilities based on evolving threats and plant feedback.
  • Support new plant projects with monitoring requirements and detection design.

Qualifications

• 6–10 years of cybersecurity experience, with a focus on OT/ICS cybersecurity in manufacturing or critical infrastructure environments.
• Experience leading SOC functions with OT monitoring responsibilities, including alert triage and incident investigation.
• Hands-on familiarity with OT monitoring platforms (e.g., Claroty, Microsoft Defender for IoT) and traditional security tools (EDR, SIEM, network monitoring).
• Working knowledge of industrial control systems (PLC, HMI, SCADA, historians, DCS) and manufacturing network architectures (Purdue Model).
• Familiarity with OT cybersecurity frameworks (NIST CSF, NIST SP 800-82, ISA/IEC 62443).
• Experience providing operational direction to managed service providers or distributed SOC teams.
• Strong understanding of IT/OT convergence challenges.
• Excellent communication skills, translating OT security risks for diverse audiences.
• Preferred certifications: GICSP, GRID, CISSP, CISM, GCIH.
• Willingness to travel up to 20% to manufacturing sites.

Education

• Bachelor's degree in Cybersecurity, Computer Science, Engineering, Information Systems, or related field required.
• Master's degree or relevant certifications (GICSP, CISSP, CISM) highly desirable.

Location & Travel

Atlanta, GA (Global Headquarters). Estimated up to 20% travel, primarily to North American manufacturing sites.

Pay

United States: $124,600 - $148,200 USD. Base pay varies based on geography, skills, and experience. Includes a full range of medical, financial, and other benefits.