Lead SOC Engineer OT Cybersecurity

About the role

The Lead SOC Engineer OT Cybersecurity will design and implement advanced threat detection capabilities for operational technology environments within CPX’s hybrid Security Operations Centers. This senior technical role focuses on engineering detection logic, integrating OT telemetry, and enhancing visibility across industrial control systems.

Key responsibilities

• Design, develop and fine‑tune OT‑specific detection use cases, correlation rules and analytics in SIEM platforms.
• Build, maintain and optimise SOAR playbooks to automate investigation and response workflows for OT and IT security events.
• Create, refine and document SOC alert logic to ensure high‑fidelity detection and smooth handover to analysts.
• Deploy, configure and optimise OT security platforms such as Dragos, Claroty and Nozomi.
• Integrate OT data sources—including PLC logs, historian data, network telemetry and asset inventories—into SOC workflows.
• Collaborate with SOC analysts and IT/OT teams to validate detections and enhance triage processes.
• Align detection and response strategies with regulatory frameworks such as NESA, SAMA, NIST 800‑82 and IEC 62443.
• Lead or support technical investigations involving OT assets during incident response.

Required profile

• 8–10 years of experience in SOC operations with a strong focus on OT cybersecurity.
• Bachelor’s degree in Computer Science, IT, Cybersecurity or related field; master’s degree or recognised certifications preferred.
• Proven experience in a lead engineering role within a SOC or industrial cybersecurity environment.

Required skills

• Python and PowerShell scripting for automation.
• SIEM use‑case development in platforms such as QRadar or Splunk.
• Deep knowledge of OT/ICS protocols (Modbus, DNP3, OPC, IEC 61850).
• Experience with OT security tools (Dragos, Claroty, Nozomi).
• Telemetry integration from PLC logs, historian data and network traffic.
• Networking certifications (CCNP/CCIE) and familiarity with SOAR solutions.