Senior SOC Engineer - OT Cybersecurity Specialist

Role Overview

We are seeking a Senior SOC Engineer specializing in Operational Technology (OT) cybersecurity to join our team remotely from Doha, Qatar. The role focuses on detecting, analyzing, and responding to cyber threats targeting industrial control systems (ICS). This position involves administration and fine-tuning of OT security solutions, monitoring OT environments, and ensuring adherence to relevant security standards.

Key Responsibilities

• Manage and support deployment and tuning of OT security tools including Nozomi and Forescout.
• Monitor OT/ICS environments using SIEM and specialized OT security platforms.
• Detect, analyze, and respond to cyber threats specifically affecting industrial control systems.
• Facilitate microsegmentation strategies aligned with the Purdue Model for OT network zones.
• Collaborate with engineering teams to execute containment actions safely in live OT settings.
• Conduct threat hunting using network and log data within industrial environments.
• Lead incident response efforts to mitigate OT cyber events minimizing operational disruptions.
• Maintain asset visibility and establish network behavior baselines within OT environments.
• Ensure compliance with security standards such as IEC 62443 and NIST ICS frameworks.
• Develop and tune detection rules, use cases, and correlation logic within SIEM platforms tailored to OT.
• Align detection use cases with MITRE ATT&CK for ICS and reduce false positives.
• Oversee onboarding of log sources and normalization of OT data for enhanced monitoring.
• Operate packet brokers and TAP/SPAN infrastructure to achieve comprehensive network visibility.
• Perform deep packet inspections on industrial protocols including Modbus, DNP3, OPC-UA, IEC 104, and Ethernet/IP.
• Analyze internal and external OT network traffic for suspicious patterns and lateral movement attempts.
• Maintain a detailed inventory of OT assets and network topologies, identifying unauthorized equipment or connections.
• Support internal and external audits by providing security evidence and contributing to compliance reporting.
• Prepare executive and operational reports detailing incidents, risks, vulnerabilities, and compliance status.

Requirements and Qualifications

• Bachelor’s degree or equivalent in Cybersecurity, Information Security, Computer Science, or closely related discipline.
• Mandatory industry certifications such as GIAC GICSP, ISA/IEC 62443 Cybersecurity Certificate, GIAC GRID, or ISA Certified Automation Cybersecurity Specialist (IACS).
• Extensive knowledge of OT/ICS systems such as SCADA, DCS, and PLCs.
• Strong understanding of OT network architecture following the Purdue Model, including DMZs and segmentation techniques.
• Experience with microsegmentation and Zero Trust principles applied to OT networks.
• Expertise in packet analysis, deep packet inspection, and operation of packet brokers and TAP/SPAN devices.
• Proficiency in SIEM and specialized OT monitoring tools like Sentinel, Nozomi, and Forescout.
• Skilled in incident response, threat hunting, anomaly detection, and vulnerability management specific to OT.
• Knowledgeable in industrial firewalling, remote access security, and compliance with IEC 62443 and NIST ICS standards.

Perks and Additional Information

This full-time remote position offers a competitive salary in the range of 24,500 to 26,000 QAR per month. The role includes the opportunity to work at the forefront of OT cybersecurity in an industrial context, supporting compliance and risk mitigation initiatives with exposure to cutting-edge security technologies.