Lead SOC Engineer (OT Cybersecurity)

Overview

The Lead SOC Engineer specializing in OT Cybersecurity is a senior technical leadership role responsible for the creation and deployment of sophisticated threat detection solutions within operational technology environments. This position operates within hybrid Security Operations Centers (SOCs) at CPX, focusing on engineering detection methodologies, integrating OT data, and boosting visibility in ICS/SCADA systems. Candidates must exhibit extensive proficiency in OT cybersecurity, threat hunting, SOC operations, and familiarity with regional industrial sectors and compliance standards.

Key Responsibilities

• Engineer and refine OT-specific detection use cases, correlation rules, and analytics in SIEM platforms to maximize threat detection accuracy and minimize false alarms.
• Develop, maintain, and enhance SOAR playbooks to automate and streamline investigation and response procedures for OT and IT security incidents.
• Construct, improve, and document alert mechanisms for SOC use, ensuring reliable detections that analysts can act on efficiently.
• Deploy, configure, and optimize OT security tools such as Dragos, Claroty, and Nozomi to expand monitoring coverage and asset discovery.
• Ingest OT telemetry—PLC logs, historian data, network traffic, and asset inventories—into SIEM/SOAR and SOC workflows.
• Collaborate closely with SOC analysts and IT/OT personnel to validate detections and enhance triage and operational processes.
• Align detection and incident response strategies with relevant regulations and frameworks, including NESA, SAMA, NIST 800-82, and IEC 62443.
• Lead or support investigations related to OT assets, providing expert analysis during incident response and post-incident evaluations.

Skills and Qualifications

• Extensive expertise in designing and deploying detection logic customized for OT infrastructures, including ICS/SCADA systems and industrial communication protocols.
• Proficient in OT/ICS protocols such as Modbus, DNP3, OPC, IEC 61850, with in-depth understanding of their behavior in cybersecurity threat contexts.
• Advanced skills in creating and tuning OT-related SIEM use cases and correlation rules (e.g., QRadar, Splunk) to enhance detection while reducing false positives.
• Experienced in onboarding various OT telemetry sources like PLC logs, historical data, and network telemetry to support SOC visibility and detection capabilities.
• Strong scripting abilities using Python and PowerShell for automation of detection workflows and custom alert development.
• Demonstrates excellent communication and teamwork capabilities to coordinate with SOC analysts, OT engineers, and response teams effectively.
• In-depth understanding of SOC operations, regional OT threat landscapes, and industrial cybersecurity challenges specific to the Middle East.

Certifications

• Cybersecurity certifications such as CISSP, CISM, or equivalents.
• OT-focused certifications including GICSP, GRID, ISA/IEC 62443 Cybersecurity, Dragos, Nozomi.
• Networking certifications like CCNP or CCIE.
• Additional accreditation related to SOAR or SIEM platforms is advantageous.

Experience and Education

• A minimum of 8 to 10 years in SOC operations with significant emphasis on OT cybersecurity.
• Previous leadership experience in engineering roles within SOCs or industrial cybersecurity environments.
• Bachelor’s degree in computer science, information technology, cybersecurity, or related discipline required.
• Master’s degree or equivalent advanced cybersecurity certifications preferred.