Suki Pabial

I’m a Cyber Security professional with 4 years of experience within a Security Operation Centre and 4 years as an Cyber Security Engineer withing IT/OT. Throughout my career I have gained a substantial amount of experience and technical skills with the ability to provide deep analysis of security events.

OT Cyber Security Specialist - Drax Group

(2026 - 2026)

• Created and updated detailed OT network diagrams using Microsoft Visio, accurately documenting infrastructure, network segmentation, and security architecture across site environments.
• Produced and maintained network documentation incorporating key OT and security assets including Darktrace, VMware ESXi hosts, NAS storage solutions, and backup servers.
• Contributed to the OT Monitoring Uplift project, supporting the deployment, configuration, and integration of OT monitoring and backup infrastructure.
• Configured and supported virtualised server environments using VMware ESXi to improve system resilience and operational visibility.
• Assisted with the installation, configuration, and hardening of Windows and Linux servers for backup and NAS infrastructure within OT environments.
• Supported backup and recovery implementation activities, including configuration of Veeam Backup & Replication solutions to enhance operational continuity and disaster recovery capabilities.
• Worked within operational technology environments to improve monitoring, infrastructure reliability, and cyber security posture across critical systems.

IT/OT Cyber Security Engineer - Scottish Power Renewables

(2021 - 2026)

• Be part of the OT Monitoring project, this involved implementing Claroty CTD which I have deployed at over 45 Onshore Windfarms (Solar & Battery included), also lead the deployment for the Offshore team
• Building a relationship with our Security Partners (Rockwell) as they aid SPR in with deployment of the CTDs and provided asset inventory list to fine tune the CTDs there for it can be signed off for SAT, this also included leading technical meetings which occurred weekly and the attendance of a Project Follow Up meetings to provide status of each CTD
• Include newly discovered IOC’s provided from the Threat Intel team within Claroty as either YARA rules or Network Signatures (Snort)
• Implemented and mange endpoint protection across SCADA systems which is Trellix (Formally McAfee ePO)
• Facilitated a Penetration Test conducted by a 3rd party company and organizing site visits
• Manage and review IT/OT vulnerabilities with the use of Claroty, exported and presented all existing Vulnerabilities within our OT environment with the team
• Triage and investigate into the alerts from Claroty, not only to discover suspicious activity but to also get a better understanding of the communications within the OT Environment
• Developed knowledge and awareness of OT Cyber Security governance, policies, and industry best practices through involvement in operational OT security activities and exposure to recognised standards including IEC 62443.
• Provided technical guidance and mentoring to a junior Cyber Security Engineer within the OT Cyber team, supporting their understanding of Cyber Security concepts, OT monitoring, vulnerability.

Security Delivery Senior Analyst (Contract) - Accenture

(2020 - 2021)

• Performing detailed analysis of the data captured by monitoring systems, with the help of the following tools; Carbon Black, LogRhythm, Cisco SourceFire (IDS), Packet Capture indexer Arkime (formerly known as Moloch)
• Escalating incidents to senior management where necessary & acting as a point of contact throughout investigation
• Recommending & implementing new signatures/rules & tuning
• Supporting client engagements and or service meetings
• Assisting in the development & mentorship of junior members of staff
• Report generation
• Handling client queries

L3 Cyber Security Analyst - SCC (Specialist Computer Centres)

(2019 - 2020)

• Monitor SCC and Customer environments for security events and breaches, investigating a violation when one occurs. As being part of the Level 3 Analyst team, incident tickets would be passed on to us from the Level 1 team if they require further assistance into an offence.
• Investigating offences with the aid of IBM Qradar and Service Now
• Daily Threat Intelligence activities with the use of 3rd party tools such has ThreatConnect, Hybrid Analysis, GreyNoise etc
• Promote new methodologies and use cases for Qradar to enhance the performance/quality of alerts that are being sent to the customer
• Working with customer tower to gain information for current and onboarding customers to update Network Hierarchy to develop accurate alerts
• Experienced on being on 24/7 On-call Stand-by where the analyst will be alerted when a P1 has been triggered out-of-hours.
• Developing ‘PlayBooks’ for future analysts on how to deal with specific offences providing best practice]
• Nessus Vulnerability scanning within SCC environment

Cyber Security Analyst - Nettitude Group

(2017 - 2019)

My role at Nettitude is SOC analyst where I was a part of the 24/7 Shift team, 4 days on 4 days off, 2 weeks of Day shift, 2 weeks of nights, 12 hours each shift. When the company’s SOC went 24/7 there was only one shift worker on each shift which eventually turned into having 2 colleagues on shift where I gained the experience of working under pressure. My duties on each shift involved the following:

• Daily ownership and management of customers; including log management, log analysis, event management and alarms with the use of SIEMS tools which included LogRhythm & Carbon Black
• Review and respond to all alarms receive within agreed SLA’s
• Ensuring each customer’s operational health is maintained and exceptions dealt with in a timely manner (Agent monitoring), any issues with Agents after contacting the customer is then reported to the Platform team.
• Triage alarms and security events before handling over to the Senior Analyst
• Maintain accurate investigation and case management records
• Providing recommendations on SIEM tunings to Senior Analyst
• Producing monthly and bi-monthly Management Reports for clients which provides a breakdown of events that have taken place within the reporting period which also includes the percentage of Server & Agent Availability
• Analysis of phishing emails where some clients may require further information of suspicious emails
• Carried out Threat Hunts against our platform with information provided by Recorded Future

Course - ICS Cybersecurity In-Depth (ICS612) - SANS (2025 - 2025)

Course - ICS/SCADA Security Essentials (ICS410) - SANS

Course - ICS Visibility, Detection, and Response (ICS515) - SANS

BEng. (Honours) - Digital Security, Forensics & Ethical Hacking - Glasgow Caledonian University (2013 - 2016)

Higher National Diploma (HND) - Computer Networking & Internetworking - Glasgow Kelvin College (formerly Stow College) (2010 - 2012)