Lead SOC Engineer (OT Cybersecurity)

About the role

The Lead SOC Engineer (OT Cybersecurity) will design and implement advanced threat detection capabilities for operational technology environments within CPX's hybrid Security Operations Centers. This senior technical leader will drive detection engineering, telemetry integration and automation across industrial control systems.

Key responsibilities

• Design, develop and fine‑tune OT‑specific detection use cases, correlation rules and analytics in SIEM platforms.
• Build, maintain and optimise SOAR playbooks to automate investigation and response for OT and IT security events.
• Create, refine and document SOC alert logic to ensure high‑fidelity detection and smooth hand‑over to analysts.
• Deploy, configure and optimise OT security platforms such as Dragos, Claroty and Nozomi.
• Integrate OT data sources—including PLC logs, historian data and network telemetry—into SIEM/SOAR workflows.
• Partner with SOC analysts, OT engineers and incident response teams to validate detections and improve triage processes.
• Align detection and response strategies with regulatory frameworks such as NESA, SAMA, NIST 800‑82 and IEC 62443.
• Lead or support technical investigations involving OT assets during incident response.

Required profile

• 8–10 years of experience in SOC operations with a focus on OT cybersecurity.
• Proven experience in a lead engineering role within an industrial cybersecurity environment.
• Bachelor’s degree in Computer Science, IT, Cybersecurity or related field; master’s degree or recognised certifications preferred.
• Relevant certifications such as CISSP, CISM, GICSP, ISA/IEC 62443, CCNP/CCIE are advantageous.

Required skills

• OT detection engineering and SOAR playbook development.
• Industrial protocols: Modbus, DNP3, OPC, IEC 61850.
• SIEM platforms: QRadar, Splunk.
• OT security platforms: Dragos, Claroty, Nozomi.
• Scripting and automation with Python and PowerShell.