OT SOC Course for Critical Infrastructure
Online 300 h OT SOC course for critical infrastructure. 6 modules covering IEC 62443, Directive (EU) 2022/2555 (NIS2) and Splunk Enterprise Security. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Define the mission, operating model and services of an OT SOC.
Design the data source architecture in industrial environments.
Develop detection use cases aligned with MITRE ATT&CK for ICS.
Develop secure response playbooks for operational continuity.
Coordinate incident management with operations and authorities.
Measure and improve SOC performance through indicators.
Propose the implementation of an OT SOC for a critical infrastructure.
Who it's for
- OT SOC analyst wishing to specialise in OT SOC for critical infrastructure.
- SOC manager wishing to specialise in OT SOC for critical infrastructure.
- Detection engineer wishing to specialise in OT SOC for critical infrastructure.
- Industrial incident response specialist wishing to specialise in OT SOC for critical infrastructure.
- Threat hunter wishing to specialise in OT SOC for critical infrastructure.
- Managed security services consultant wishing to specialise in OT SOC for critical infrastructure.
- Engineering or science graduates seeking to enter the energy sector.
What you'll work with
- IEC 62443
- Directive (EU) 2022/2555 (NIS2)
- NIST SP 800-82 Rev. 3
- NIST SP 800-61 Rev. 2
- ISO/IEC 27035
- Directive (EU) 2022/2557 (CER)
- Law 8/2011 on the protection of critical infrastructure
- ISO/IEC 27001
6 modules · 300 h
1.1Mission and services of an OT SOC1.2Differences between IT SOC and OT SOC1.3Internal, external and hybrid models1.4Analyst levels and escalation1.5Integration with the operations control centre1.6Critical infrastructure requirements1.7People, processes and technology1.8MTTD and MTTR metrics1.9SOC maturity with SOC-CMM1.10Workshop: designing the service catalogue of an OT SOC
2.1Passive network monitoring sensors2.2HMI, historian and engineering workstation logs2.3Firewall events and remote access2.4Industrial endpoint telemetry2.5Asset inventory and criticality2.6Log collection architecture in OT environments2.7Event normalisation and enrichment2.8Retention and chain of custody2.9Visibility in remote substations2.10Laboratory: integrating OT sensors into a SIEM
3.1Correlation rules for industrial protocols3.2Detection use cases in energy and water3.3Mapping detections to MITRE ATT&CK for ICS3.4Behavioural detection and baselines3.5Proactive threat hunting3.6Sector-specific threat intelligence3.7Triage and false-positive reduction3.8Analysis of industrial traffic captures3.9Automation with SOAR3.10Practice: developing detection use cases
4.1Response playbooks for OT environments4.2Incident classification and prioritisation4.3Coordination with process engineers4.4Safe containment without interrupting operations4.5Forensic analysis of control systems4.6Communication with authorities and CSIRTs4.7Crisis management in critical infrastructure4.8Post-incident reports4.9Cyber-resilience exercises4.10Case study: playbook for unauthorised remote access
5.1Shifts, on-call duties and staff management5.2Analyst training and certification5.3Coordinated vulnerability management5.4Service indicators and service level agreements5.5Audit and NIS2 compliance5.6Managed service provider management5.7SOC costs and sizing5.8Technological evolution and automation5.9Collaboration in sector ISACs5.10Case study: OT SOC dashboard
6.1Characterisation of the infrastructure6.2SOC operating model6.3Data source architecture6.4Catalogue of detection use cases6.5Response playbooks6.6Staffing and training plan6.7Budget and indicators6.8Implementation roadmap6.9Report and presentation6.10Final review with the tutor
How you'll learn
100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which makes it compatible with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Splunk Enterprise Security, Microsoft Sentinel, Nozomi Networks Guardian, Zeek, TheHive, in free, academic or evaluation versions. The practical work is based on real procedures for integrating industrial network sensors into a SIEM, developing detection use cases for control protocols, and a response exercise with playbooks in a simulated environment. Assessment is continuous per module plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Define the mission, operating model and services of an OT SOC.
Design the data source architecture in industrial environments.
Develop detection use cases aligned with MITRE ATT&CK for ICS.
Develop secure response playbooks for operational continuity.
Coordinate incident management with operations and authorities.
Where this takes you
Requirements
- No prior degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient command of Spanish to follow technical regulatory reading.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 300 hours, spread over 3 to 5 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The programme uses Splunk Enterprise Security, Microsoft Sentinel, Nozomi Networks Guardian, Zeek, TheHive. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the integrative project. It is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Check the recognition policy when you enrol.
Related programmes
Course on AI Applied to Electricity Price Forecasting
Online 300 h course in AI applied to electricity price forecasting. 6 modules covering Regulation (EU) No 1227/2011 (REMIT), Regulation (EU) 2019/943 on the internal market…
Course in Digital Substations with IEC 61850
The Digital Substations with IEC 61850 Course offers comprehensive training in the implementation and management of digital systems in electrical substations. It focuses on the IEC…
Electrical Integration of Hydrogen in Plants Course
Online 300-hour course in electrical integration of hydrogen in plants. 6 modules covering Regulation (EU) 2016/1388 (demand connection network code), IEC 61000-3-6 and DIgSILENT PowerFactory. Assigned…
More in Energy and Networks
All Energy and Networks programmes → · How to apply · Fees & financing · Scholarships