Lead Incident Response – OT Cyber Security

About the role

We are seeking a Lead Incident Response professional specialized in Operational Technology (OT) and Industrial Control Systems (ICS) to protect our critical infrastructure in Abu Dhabi. The role combines hands‑on technical work with leadership of cross‑functional response teams across OT and IT environments.

Key responsibilities

• Lead OT/ICS and IT incident response engagements from detection through recovery.
• Apply the Purdue Model to assess and contain threats across Levels 0‑4.
• Perform hands‑on analysis of PLCs, HMIs, DCS, RTUs and SCADA platforms (Siemens, Allen‑Bradley, Schneider, etc.).
• Conduct log analysis using SIEM and OT‑specific tools such as Claroty, Dragos, Nozomi and Tenable OT.
• Utilize MITRE ATT&CK for ICS to scope incidents and develop mitigation strategies.
• Navigate OT constraints including legacy systems, limited patching windows and operational safety requirements.

Required profile

• Proven experience in OT/ICS environments and incident response.
• Strong understanding of OT architectures and the Purdue Model.
• Ability to lead multidisciplinary teams and communicate findings to both technical and business stakeholders.

Required skills

• Hands‑on work with PLCs, HMIs, DCS, RTUs and SCADA systems.
• Familiarity with Siemens, Allen‑Bradley and Schneider control hardware.
• Experience with SIEM platforms and OT security tools (Claroty, Dragos, Nozomi, Tenable OT).
• Knowledge of MITRE ATT&CK for ICS.