Senior OT Detection Engineer & SOC Automation Lead

Cpx Affiliate; Abu Dhabi; Hybrid; AED 400,000 - 650,000; Full time

Job summary

CPX is seeking a senior OT Detection Engineer to design and implement advanced threat detection in OT environments, integrating OT telemetry into SIEM/SOAR and coordinating with SOC analysts. You will lead the development of OT-specific use cases and automate responses across OT/IT security events.

The role demands deep OT cybersecurity expertise, strong protocol knowledge (Modbus, DNP3, OPC, IEC 61850), and experience with Dragos, Claroty, Nozomi, QRadar or Splunk.

Qualifications

• 8–10+ years in SOC operations with OT cybersecurity.
• Lead engineering experience in an SOC/industrial cybersecurity environment.
• Bachelor's degree in computer science, information technology, cybersecurity, or related field.

Responsibilities

• Design, develop and tune OT-specific detection use cases and analytics in SIEM platforms.
• Build, maintain and optimize SOAR playbooks for OT/IT security events.
• Create, refine and document SOC alert logic for high fidelity detections.
• Deploy, configure and optimize OT security platforms (Dragos, Claroty, Nozomi).
• Integrate OT telemetry sources into SOC workflows (PLC logs, historian data, network telemetry, asset inventories).
• Collaborate with SOC analysts and OT/IT teams to validate detections and improve triage processes.
• Ensure alignment with regulatory frameworks (NESA, SAMA, NIST 800-82, IEC 62443).
• Lead or support investigations and post-incident reviews for OT assets.

Skills

OT Detection Engineering

Threat Hunting

SIEM Use Cases

Telemetry Integration

Python Scripting

OT Protocols

Cross-Functional

Industrial OT

Education

Bachelor's degree in CS/IT/Cybersecurity

Master's degree or relevant certifications

Tools

Dragos

Claroty

Nozomi

QRadar

Splunk

Job description

CPX is seeking a senior OT Detection Engineer to design and implement advanced threat detection in OT environments, integrating OT telemetry into SIEM/SOAR and coordinating with SOC analysts. You will lead the development of OT-specific use cases and automate responses across OT/IT security events.

The role demands deep OT cybersecurity expertise, strong protocol knowledge (Modbus, DNP3, OPC, IEC 61850), and experience with Dragos, Claroty, Nozomi, QRadar or Splunk.