Lead SOC Engineer OT Cybersecurity

About the role

We are looking for a senior technical leader to design and implement advanced threat detection capabilities for operational technology (OT) environments. The Lead SOC Engineer will work within CPX’s hybrid Security Operations Centers, focusing on engineering detection logic, integrating OT telemetry, and improving visibility across industrial control systems.

Key responsibilities

• Design, develop, and fine‑tune OT‑specific detection use cases, correlation rules, and analytics in SIEM platforms.
• Build, maintain, and optimise SOAR playbooks to automate investigation and response for OT and IT security events.
• Create, refine, and document high‑fidelity SOC alert logic and ensure smooth hand‑over to analysts.
• Deploy, configure, and optimise OT security platforms such as Dragos, Claroty, and Nozomi.
• Integrate OT data sources—including PLC logs, historian data, network telemetry, and asset inventories—into SOC workflows.
• Collaborate with SOC analysts and IT/OT teams to validate detections and enhance triage processes.
• Align detection and response strategies with regulatory frameworks like NESA, SAMA, NIST 800‑82, and IEC 62443.
• Lead or support technical investigations involving OT assets during incidents and post‑incident reviews.

Required profile

• Extensive experience in OT cybersecurity and SOC operations.
• Strong knowledge of industrial protocols and their security implications.
• Proven ability to design high‑fidelity detection logic for OT environments.
• Familiarity with regional industrial sectors and compliance requirements.

Required skills

• SIEM platforms (e.g., QRadar, Splunk)
• SOAR orchestration
• OT security tools: Dragos, Claroty, Nozomi
• Industrial protocols: Modbus, DNP3, OPC, IEC 61850
• Telemetry integration from PLCs, historians, and network devices