Lead OT SOC Engineer

Investigo; Leeds, Glasgow; Hybrid; GBP 100,000 - 125,000; Full time

Job summary

Investigo is seeking a seasoned OT security leader to build an OT SOC capability from the ground up. You will define monitoring, detection engineering, incident response and client delivery across critical infrastructure environments.

You'll shape the service, influence the tech stack, and mentor the team to become the go-to OT expert in the business. This is a hands-on leadership role with broad strategic impact.

Qualifications

• Strong OT / ICs security experience.
• Solid understanding of industrial protocols and Purdue Model.
• Experience protecting manufacturing, energy, utilities or critical infrastructure environments.
• Ability to blend hands-on technical expertise with strategic thinking.

Responsibilities

• Build and evolve an OT SOC capability from scratch.
• Design and refine OT detection use cases, alerting and response processes.
• Lead incident response activities across industrial environments.
• Collaborate with technology vendors and SIEM platforms.
• Act as the technical authority for OT security internally and externally.
• Grow the team and set standards as capability scales.

Skills

OT security

Industrial protocols

Purdue Model

Tools

Claroty

Dragos

Nozomi

CrowdStrike

SIEM

Job description

Location - North East, London or Glasgow

Salary - Happy to discuss ranges into the 100k+ mark

Hybrid - 3 Days a week on site

Most OT security roles ask you to maintain something that's already been built.

This isn't one of those roles.

This is an opportunity to be the person who builds an OT SOC capability from the ground up.

The strategy is there. The backing is there. The demand is there.

Now we need someone who knows OT security inside out and wants to put their fingerprint on something from day one.

You’ll be the technical driving force behind a new OT SOC function, helping define how monitoring, detection engineering, incident response and client delivery should look across critical infrastructure and Operational Technology environments.

You’ll help shape the service, influence the technology stack, create the standards, build the playbooks, mentor future team members and become the go-to OT expert within the business.

What you’ll own

• Building and evolving an OT SOC capability from scratch
• Designing and refining OT detection use cases, alerting and response processes
• Leading incident response activities across industrial environments
• Working with technologies such as Claroty, Dragos, Nozomi, CrowdStrike and SIEM platforms
• Acting as the technical authority for OT security internally and externally
• Helping grow the team, sharing knowledge and setting the standard as the capability scales

What you’ll need

• Strong OT / ICs security experience
• A solid understanding of industrial protocols, network segmentation and the Purdue Model
• Experience protecting manufacturing, energy, utilities or critical infrastructure environmentsThe ability to blend hands‑on technical expertise with strategic thinking
• The confidence to build, influence and lead rather than simply maintain

Why this role stands out

Let’s be honest.

There are plenty of OT security jobs where you’ll inherit a mature function and spend your time keeping the wheels turning.

This isn’t that.

This is for someone who wants to build something.

You’ll have genuine influence over how the OT SOC evolves, the technologies used, the standards adopted and the service clients receive.

If you’ve ever wanted to be the person who says "I built that" rather than "I inherited that", this could be a brilliant fit.