Lead SOC Engineer (OT Cybersecurity) (CPX)

OT Detection is a senior technical and engineering leader role focused on designing and implementing advanced threat detection capabilities within OT environments. Operating within CPX\u2019s hybrid Security Operations Centers (SOCs), this role emphasizes engineering detection logic, integrating OT telemetry, and enhancing visibility across ICS/SCADA systems. The position requires deep expertise in OT cybersecurity, threat hunting, and SOC operations, with a strong understanding of regional industrial sectors and compliance frameworks. Skills/Certifications (Technical & Non-Technical : - \u2022 Advanced OT Detection Engineering: Proven ability to design and implement high-fidelity detection logic tailored to OT environments, including ICS/SCADA systems and industrial protocols.\u00A0 \u2022 Deep Protocol Expertise: Strong hands-on experience with OT/ICS protocols such as Modbus, DNP3, OPC, IEC 61850, and their behavioral patterns in threat scenarios.\u00A0 \u2022 SIEM Use Case Development: Extensive experience building and tuning OT-specific use cases and correlation rules in SIEM platforms (e.g., QRadar, Splunk), with a focus on minimizing false positives and enhancing alert fidelity.\u00A0 \u2022 Telemetry Integration: Skilled in onboarding OT telemetry sources (e.g., PLC logs, historian data, network traffic) into SOC workflows for enhanced visibility and detection.\u00A0 \u2022 Scripting & Automation: Proficient in Python and PowerShell for automating detection workflows, parsing OT logs, and building custom alerting mechanisms.\u00A0 \u2022 Cross-Domain Collaboration: Strong communication and collaboration skills to work effectively with SOC analysts, OT engineers, and incident response teams.\u00A0 \u2022 Operational Awareness: Deep understanding of SOC operations, OT threat landscapes, and the unique challenges of securing industrial environments in the Middle East. \u2022 Cybersecurity: CISSP, CISM, or equivalent. \u2022 OT-Specific: GICSP, GRID, ISA/IEC 62443 Cybersecurity Certificate, Dragos, Nozomi. \u2022 Networking: CCNP/CCIE. \u2022 Additional certifications related to SOAR or SIEM solutions would be considered an advantage \u2022 Minimum of 8\u201310 years in SOC operations, with significant experience in OT cybersecurity. \u2022 Prior experience in a lead engineering role within a SOC or industrial cybersecurity environment. \u2022 Bachelor\u2019s degree in computer science, Information Technology, Cybersecurity, or related field. \u2022 Master\u2019s degree or equivalent recognized cybersecurity certifications preferred

Minimum of 8-10 years in SOC operations, with significant experience in OT cybersecurity. Prior experience in a lead engineering role within a SOC or industrial cybersecurity environment. Bachelor's degree in computer science, Information Technology, Cybersecurity, or related field. Master's degree or equivalent recognized cybersecurity certifications preferred. Certifications: CISSP, CISM or equivalent; OT-specific: GICSP, GRID, ISA/IEC 62443 Cybersecurity Certificate, Dragos, Nozomi; Networking: CCNP/CCIE. Additional certifications related to SOAR or SIEM solutions would be considered an advantage.

Design and implement high-fidelity OT threat detection capabilities for OT environments; engineer detection logic and SIEM use cases; integrate OT telemetry (PLC logs, historian data, network traffic) into SOC workflows; collaborate with SOC analysts, OT engineers, and incident response teams; maintain deep knowledge of SOC operations and OT threat landscapes to secure industrial environments in the Middle East.