Senior OT SOC Engineer — Industrial Cyber Resilience Lead

Black & Grey HR; Doha; On-site; QAR 240,000 - 360,000; Full time

Job summary

Black & Grey HR in Doha, Qatar, seeks an experienced Senior SOC Engineer – OT Security to lead advanced security monitoring, threat detection, incident response, and threat hunting across OT/ICS environments. You will work with Nozomi, Forescout, and SIEM platforms to strengthen cyber resilience without disrupting critical operations.

The role requires 8+ years in cybersecurity, OT security, and ICs, with a strong grasp of MITRE ATT&CK for ICs, IEC 62443, and NIST ICs.

Qualifications

• 8+ years of experience in cybersecurity, SOC operations, OT security, ICs security, or information security.
• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or a related field.

Responsibilities

• Administer, manage, support deployment, and tune OT security monitoring tools such as Nozomi and Forescout.
• Monitor OT/ICS environments using SIEM and specialized OT security monitoring platforms.
• Detect, investigate, analyze, and respond to cyber threats targeting industrial control systems.
• Maintain OT asset visibility and establish network behavior baselines.
• Support micro-segmentation strategies across OT network zones in alignment with the Purdue Model.
• Collaborate with OT engineering teams to safely implement containment actions in live industrial environments.
• Handle OT cyber incidents while minimizing operational disruption.
• Work with industrial firewalls, IDS/IPS, NAC, and network segmentation technologies.
• Develop and continuously tune OT-specific detection rules and correlation logic within SIEM platforms.
• Align detection use cases with the MITRE ATT&CK for ICs framework.
• Reduce false positives while improving detection accuracy, coverage, and operational effectiveness.
• Periodically review and optimize alert thresholds and detection logic.
• Support OT security architecture integrating SIEM, IDS/IPS, packet brokers, and segmentation technologies.
• Assist with onboarding OT log sources, parser development, and data normalization.
• Optimize dashboards, alerts, and reporting to improve OT security visibility.
• Operate and support packet brokers, network TAPs, SPAN infrastructure, and related technologies to enable comprehensive OT network visibility.
• Perform deep packet inspection and traffic analysis across industrial protocols including Modbus, DNP3, OPC-UA, IEC 104, and Ethernet/IP.
• Analyze east-west and north-south traffic to identify suspicious activity, lateral movement, and unauthorized communications.
• Identify protocol anomalies and deviations from established OT network behavior.
• Support network telemetry collection and traffic visibility across industrial environments.
• Maintain accurate OT asset inventories and network topology visibility.
• Identify unauthorized devices, rogue connections, and shadow OT assets.
• Conduct proactive threat hunting using security logs, network telemetry, behavioral analytics, and threat intelligence.
• Correlate threat intelligence with OT vulnerabilities, assets, and operational risks.
• Support OT risk assessments and initiatives to improve overall security posture.
• Ensure compliance with IEC 62443, NIST ICs, ISO standards, and internal cybersecurity policies.
• Support internal and external audits by preparing security evidence and compliance documentation.
• Prepare and present OT security reports covering incidents, vulnerabilities, risks, trends, and overall security posture.
• Maintain dashboards covering threats, vulnerabilities, assets, compliance, and remediation status.
• Communicate critical incidents, security risks, and recommended actions to SOC, OT engineering, and business stakeholders.
• Provide executive-level reporting on OT security exposure, threat posture, and remediation progress.
• Track remediation activities, SLAs, and outstanding security risks.
• Support audit, regulatory, and compliance reporting requirements.

Skills

OT security

SOC operations

Threat hunting

Incident response

Asset visibility

MITRE ATT&CK for ICs

IEC 62443

NIST ICs

Education

Bachelor's degree in Cybersecurity/Information Security/CS

Tools

Nozomi

Forescout

Microsoft Sentinel

SIEM

Job description

Black & Grey HR in Doha, Qatar, seeks an experienced Senior SOC Engineer – OT Security to lead advanced security monitoring, threat detection, incident response, and threat hunting across OT/ICS environments. You will work with Nozomi, Forescout, and SIEM platforms to strengthen cyber resilience without disrupting critical operations.

The role requires 8+ years in cybersecurity, OT security, and ICs, with a strong grasp of MITRE ATT&CK for ICs, IEC 62443, and NIST ICs.