Lead SOC Engineer – OT Cybersecurity

About the role

The Lead SOC Engineer – OT Cybersecurity is a senior technical leader responsible for designing and implementing advanced threat detection capabilities across operational technology (OT) environments. Working within CPX’s hybrid Security Operations Centers, the role focuses on engineering detection logic, integrating OT telemetry, and improving visibility for industrial control and SCADA systems.

Key responsibilities

• Design, develop and fine‑tune OT‑specific detection use cases, correlation rules and analytics within SIEM platforms.
• Build, maintain and optimise SOAR playbooks to automate investigation and response for OT and IT security events.
• Create, refine and document SOC alert logic to ensure high‑fidelity detection and smooth hand‑over to analysts.
• Deploy, configure and optimise OT security platforms such as Dragos, Claroty and Nozomi.
• Integrate OT data sources—including PLC logs, historian data, network telemetry and asset inventories—into SIEM/SOAR workflows.
• Collaborate closely with SOC analysts and IT/OT teams to validate detections and enhance triage processes.
• Align detection and response strategies with regulatory frameworks such as NESA, SAMA, NIST 800‑82 and IEC 62443.
• Lead or support technical investigations involving OT assets during incident response and post‑incident reviews.

Required profile

• Extensive experience in OT cybersecurity and threat hunting within industrial environments.
• Hands‑on expertise with OT/ICS protocols (Modbus, DNP3, OPC, IEC 61850) and their behavior in threat scenarios.
• Proven ability to design high‑fidelity detection logic for OT/SCADA systems.
• Strong understanding of compliance requirements for the industrial sector.
• Excellent communication skills to work with cross‑functional SOC and OT teams.

Required skills

• Python
• PowerShell
• SIEM platforms (QRadar, Splunk)
• SOAR platforms
• OT security tools (Dragos, Claroty, Nozomi)
• OT/ICS protocols (Modbus, DNP3, OPC, IEC 61850)
• Telemetry integration and analytics