OT Detection Engineer | Agentic AI for Security Automation
I build OT detection that holds up in production and AI agents that SOC analysts can actually trust. My work sits at the intersection of detection engineering, industrial protocols and security automation: Sigma and Suricata content, protocol-aware telemetry, ATT&CK for ICS coverage, and agentic workflows with least privilege, tool allowlists, human approval and audit trails.
Currently OT Detection Engineer @ Rockwell Automation, working across OT detection, incident response and an internal AI-assisted SOC triage workflow.
Spain · EU citizen · open to EU remote, hybrid and B2B engagements
- OT detection engineering: Sigma and native Suricata rules, protocol-aware deep packet inspection, MITRE ATT&CK for ICS coverage, detection quality metrics and adversary emulation.
- OT/ICS security and response: Purdue and IEC 62443 segmentation, Claroty and Nozomi monitoring, incident triage, threat hunting, vulnerability tracking and IR runbooks.
- Agentic AI for security: local-model SOC triage, RAG over playbooks, tool allowlists, read-only service accounts, human approval gates, audit logging and Splunk/Sentinel detection logic.
Detection-as-code for OT: one Sigma source converted in CI into Splunk, Microsoft Sentinel, OpenSearch and Loki queries, plus native Suricata DPI for Modbus, DNP3, OPC UA and S7comm, with Rust decoders for application-layer DNP3, S7comm and OPC UA events.
21 Sigma and 24 native Suricata rules, 246 tests, ATT&CK for ICS v19.2 coverage of 17/97 techniques, 0.0 FPR on 52 benign events, 4/4 emulation expectations detected and 2.45 s mean MTTD. Also validated inside a Malcolm pipeline and a live OT lab.
Sigma Suricata Rust Splunk Microsoft Sentinel OpenSearch Loki CI/CD
RAG-based SOC triage that summarises alerts, retrieves playbook context and drafts NIST SP 800-61 reports with human review. OAuth-scoped tools, deny-by-default tool authorization, human approval gates and hash-chained audit logging.
AI threat model mapped to OWASP LLM Top 10, MITRE ATLAS and NIST AI RMF, with a 14-case AI red-team suite, poisoning/evasion experiments and 172 deterministic tests (135 security/agent-stack).
Python LangChain ChromaDB FastAPI RAG Local models Docker
Five-zone, ten-conduit water-treatment lab on the Purdue Model, with 3 OpenPLC PLCs, Scada-LTS, InfluxDB and every inter-zone conduit enforced through an iptables gateway.
16/16 compliance checks replay 17 detection types across Modbus, DNP3, OPC UA and S7comm, including PowerShell 7 and optional Caldera adversary emulation, with evidence in Grafana/Loki. 130 tests, 13 CI gates and 72.7% IEC 62443-3-3 coverage across 12 requirements, plus gap analysis, threat model, risk register and BIA, IR playbook and STIG-style hardening guides.
OpenPLC Scada-LTS Modbus DNP3 OPC UA iptables Grafana Loki
Serverless AWS pipeline for OT, identity, Kubernetes and vulnerability telemetry: S3, SQS, Lambda, DynamoDB and Parquet, with scoped IAM, KMS, Secrets Manager and TLS-only bucket policies.
Seven OT, seven CloudTrail/GuardDuty identity and eight Kubernetes/Falco rules, plus a Nessus/Qualys vulnerability plane with EPSS/KEV enrichment and SLA reporting. 136 tests across parsers, rules and the vulnerability pipeline.
AWS Terraform CloudTrail GuardDuty Lambda Parquet Python
Dragos CTF 2026 — built and ran FORGE-OT, an evidence-first OT/ICS mission system. Cleared 57/57 visible challenges for 28,600 points with no hints; 52 solves were driven by FORGE-OT, tying the maximum score (60 teams, 58th on time tie-break).
Detection: Sigma, Suricata, Splunk, Microsoft Sentinel, Wazuh, OpenSearch, MITRE ATT&CK for ICS
OT/ICS: IEC 62443, Purdue Model, Modbus, DNP3, OPC UA, S7comm, IEC 61850
Agentic AI: LangChain/LangGraph, RAG, local models, OAuth2 scopes, MCP, audit trails
Engineering: Python, Rust, AWS, Terraform, Docker, Kubernetes, CI/CD
Claroty Implementation Engineer (IND) · Claroty Cybersecurity Analyst · Claroty Support Engineer · ISC2 CC · IEC 62443 IC32 in progress · GICSP planned
OT detection, OT/ICS security and AI-security roles in the EU. Remote, hybrid or B2B. Based in Madrid, available to relocate for the right role.