Lead SOC Engineer (OT Cybersecurity)

About the role

This is a senior technical and engineering leadership role focused on designing and implementing advanced threat detection in OT environments. It sits within CPX's hybrid Security Operations Centers (SOCs) and covers detection engineering, OT telemetry integration and visibility across ICS/SCADA systems. The position requires deep expertise in OT cybersecurity, threat hunting and SOC operations, with knowledge of regional industrial sectors and compliance frameworks.

Key responsibilities

• Design, develop and fine-tune OT-specific detection use cases, correlation rules and analytics in SIEM platforms to reduce false positives.
• Build, maintain and optimise SOAR playbooks to automate investigation and response workflows for OT and IT security events.
• Create, refine and document SOC alert logic so analysts receive high-fidelity alerts and clear handover.
• Deploy, configure and optimise OT security platforms such as Dragos, Claroty and Nozomi.
• Integrate OT data sources (PLC logs, historian data, network telemetry, asset inventories) into SIEM/SOAR and SOC workflows.
• Work with SOC analysts and IT/OT teams to validate detections and improve triage.
• Ensure detection and response strategies align with frameworks such as NESA, SAMA, NIST 800-82 and IEC 62443.
• Lead or support technical investigations of OT assets during incidents and post-incident reviews.

Required profile

• Minimum of 8-10 years in SOC operations, with significant OT cybersecurity experience.
• Prior experience in a lead engineering role within a SOC or industrial cybersecurity environment.
• Bachelor's degree in computer science, information technology, cybersecurity or a related field; master's degree or equivalent recognised cybersecurity certification preferred.

Required skills

• Advanced OT detection engineering for ICS/SCADA systems and industrial protocols (Modbus, DNP3, OPC, IEC 61850).
• SIEM use case development (e.g. QRadar, Splunk) and telemetry integration.
• Scripting and automation with Python and PowerShell.
• Certifications such as CISSP, CISM, GICSP, GRID, ISA/IEC 62443, Dragos or Nozomi; CCNP/CCIE networking; additional SOAR or SIEM certifications are an advantage.