Lead OT SOC Architect: Build & Defend Critical Infra

Jacobs; Houston (TX); On-site; USD 180,000 - 240,000; Full time

Job summary

Jacobs is seeking a Lead OT SOC Architect to design and lead a productized, multi-tenant OT Security Operations Center delivered as a managed service. You will architect the SIEM and detection-engineering platform, define triage workflows, and guide SOC engineers and analysts in complex investigations with a focus on OT/ICS and Purdue IEC 62443 alignment.

You will partner with sales and delivery to embed OT SOC capabilities into client programs, while driving continuous operational assurance and

Qualifications

• Extensive experience designing, building, and operationalizing a Security Operations Center (SOC) from the ground up — platform, detection content, workflows, and team.
• 10+ years in cybersecurity with deep Security Operations expertise, including 5+ years in a lead, architect, or senior technical role directing SOC design and operations.
• Extensive experience applying the SOC-CMM (SOC Capability Maturity Model) to assess, benchmark, and continuously mature a SOC function.
• Expert-level hands‑on SIEM architecture and detection-engineering experience (Elastic strongly preferred; see tools).
• Demonstrated experience leading and mentoring SOC analysts and engineers, and serving as a lead escalation point for advanced investigations.
• Proven detection‑engineering depth with MITRE ATT&CK for IC, and knowledge of OT/ICS contexts.
• Strong understanding of networking fundamentals and Purdue Model IEC 62443 alignment.
• Experience with OT/ICS security architectures, IAM/PAM, Zero Trust, and secure remote access.
• Experience delivering managed security services and multi‑client service models.
• Familiarity with NIST CSF, CIS Controls, and OT frameworks.

Responsibilities

• Architect the OT SOC platform and service, leading detection engineering and operations design.
• Lead SOC engineers and analysts; set investigation standards and escalation criteria.
• Define continuous operational assurance and translation of OT telemetry into actionable detections.
• Coordinate with controls, instrumentation, and systems teams to integrate OT control systems.
• Produce leadership- and client-facing reporting on SOC posture and coverage.
• Support client engagements and business development with OT security depth.
• Guide incident escalation during high-severity events and after-hours support.

Skills

SOC architecture

SIEM design

Threat hunting

MITRE ATT&CK

OT/ICS security

NIST CSF / 800-53

Zero Trust

Leadership

Mentoring

Networking fundamentals

Tools

Elastic

Splunk

Job description

Jacobs is seeking a Lead OT SOC Architect to design and lead a productized, multi-tenant OT Security Operations Center delivered as a managed service. You will architect the SIEM and detection-engineering platform, define triage workflows, and guide SOC engineers and analysts in complex investigations with a focus on OT/ICS and Purdue IEC 62443 alignment.

You will partner with sales and delivery to embed OT SOC capabilities into client programs, while driving continuous operational assurance and