Lead OT Security Engineer

Investigo; Greater London, North East, Glasgow; Hybrid; GBP 100,000 - 130,000; Full time

Job summary

Investigo is seeking a pivotal OT Security Architect to build an OT SOC capability from the ground up. You will define monitoring, detection engineering, incident response and client delivery for critical infrastructure OT environments.

You will shape the service, influence the technology stack, create standards, build playbooks, mentor team members and become the go-to OT expert within the business. This is a rare chance to build something impactful.

Qualifications

• Strong OT / ICS security experience.
• Solid understanding of industrial protocols and Purdue Model.
• Experience protecting manufacturing, energy, utilities or critical infrastructure environments.
• Ability to blend hands-on technical expertise with strategic thinking.
• Confidence to build, influence and lead rather than simply maintain.

Responsibilities

• Building and evolving an OT SOC capability from scratch.
• Designing and refining OT detection use cases, alerting and response processes.
• Leading incident response activities across industrial environments.
• Working with technologies such as Claroty, Dragos, Nozomi, CrowdStrike and SIEM platforms.
• Acting as the technical authority for OT security internally and externally.
• Helping grow the team, sharing knowledge and setting the standard as the capability scales.

Skills

OT security experience

Industrial protocols

Purdue Model

Manufacturing/critical infrastructure

Hands-on and strategic thinking

Leadership and influencing

Tools

Claroty

Dragos

Nozomi

CrowdStrike

SIEM platforms

Job description

Location - North East, London or Glasgow

Salary - Happy to discuss ranges into the 100k+ mark

Hybrid - 3 Days a week on site

Most OT security roles ask you to maintain something that's already been built.

This isn't one of those roles.

This is an opportunity to be the person who builds an OT SOC capability from the ground up.

The strategy is there. The backing is there. The demand is there.

Now we need someone who knows OT security inside out and wants to put their fingerprint on something from day one.

You'll be the technical driving force behind a new OT SOC function, helping define how monitoring, detection engineering, incident response and client delivery should look across critical infrastructure and Operational Technology environments.

You'll help shape the service, influence the technology stack, create the standards, build the playbooks, mentor future team members and become the go-to OT expert within the business.

What you'll own

• Building and evolving an OT SOC capability from scratch
• Designing and refining OT detection use cases, alerting and response processes
• Leading incident response activities across industrial environments
• Working with technologies such as Claroty, Dragos, Nozomi, CrowdStrike and SIEM platforms
• Acting as the technical authority for OT security internally and externally
• Helping grow the team, sharing knowledge and setting the standard as the capability scales

What you'll need

• Strong OT / ICs security experience
• A solid understanding of industrial protocols, network segmentation and the Purdue Model
• Experience protecting manufacturing, energy, utilities or critical infrastructure environments
• The ability to blend hands-on technical expertise with strategic thinking
• The confidence to build, influence and lead rather than simply maintain

Why this role stands out

Let's be honest.

There are plenty of OT security jobs where you'll inherit a mature function and spend your time keeping the wheels turning.

This isn't that.

This is for someone who wants to build something.

You'll have genuine influence over how the OT SOC evolves, the technologies used, the standards adopted and the service clients receive.

If you've ever wanted to be the person who says 'I built that' rather than 'I inherited that', this could be a brilliant fit.