Senior OT Security Engineer

Cynet Systems•Dallas, TX

About The Position

The Senior OT Security Engineer oversees SOC operations during assigned shifts, ensuring efficient workflow, proper escalation procedures, adherence to SLAs, and effective communication among analysts. The role leads investigations and response to complex incidents affecting OT systems, networks, and applications, and coordinates response efforts with other teams and business units. The engineer analyzes security alerts and logs from ICS/SCADA environments, makes real-time decisions about incident severity and containment, and reviews actions taken by Tier 1 and Tier 2 analysts. The role evaluates SOC security technologies, optimizes detection rules, develops custom detections and use cases tailored to OT environments, and proactively searches for indicators of compromise and misconfigurations. The position also maintains incident response playbooks, procedures, runbooks, and incident documentation; prepares reports for management; and provides guidance, training, and mentorship to junior analysts. The engineer participates in training and simulations and stays current with OT security threats, practices, tools, and relevant standards and frameworks. Success is measured by effective incident leadership, improved detection and response indicators, stronger threat coverage, meeting project objectives and SOC SLAs, and improved cross-functional communication.

Requirements

Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field.
Minimum of 5–7 years of experience in a cybersecurity-focused role; SOC experience is strongly preferred.
At least 3 years of direct experience with OT/ICS environments, including hands-on knowledge of SCADA systems, PLCs, RTUs, HMIs, and industrial networks.
Deep understanding of cybersecurity fundamentals, including TCP/IP, UDP, and DNS; Windows and Linux operating systems; and security architecture principles.
Strong knowledge of OT protocols including DNP3, Modbus, IEC 104, and OPC UA, including packet analysis and protocol vulnerabilities.
Experience with SIEM, SOAR, IIDS/IPS, endpoint detection solutions, and network traffic analysis tools.
Strong analytical skills and attention to detail, including the ability to analyze complex data, identify patterns, and draw meaningful conclusions.
Strong verbal and written communication skills, including the ability to communicate technical information to technical and non-technical stakeholders and create clear, concise reports.
Demonstrated ability to lead and mentor junior analysts.
Ability to work in a 24/7 shift-based SOC environment, cover for teammates, and provide occasional after-hours support.
Ability to prioritize and multitask, adapt to a fast-paced changing environment, and interface professionally with internal and external business partners.

Nice To Haves

Master's degree.
Advanced certifications such as CySA+, CEH, OSCP, GICSP, CCNA Security, or relevant OT security certifications such as ISA/IEC 62443.
SOC experience.

Responsibilities

Oversee SOC operations during assigned shifts, including workflow, escalation procedures, SLA adherence, and communication between analysts.
Lead investigations and responses to complex security incidents affecting OT systems, networks, and applications, coordinating with other teams and business units.
Analyze security alerts and logs common in ICS/SCADA systems to identify indicators of compromise.
Make real-time decisions on incident severity, containment strategies, and escalation paths; review actions taken by Tier 1 and Tier 2 analysts.
Evaluate SOC security technologies, provide feedback on their performance, and oversee detection-rule optimization to reduce false positives.
Develop, test, and implement custom detection rules, correlation searches, baseline drift detections, and use cases tailored to OT protocols and environments.
Proactively search OT environments for indicators of compromise and misconfigurations using threat intelligence, anomaly detection, and knowledge of ICS/SCADA attacker tactics, techniques, and procedures.
Create, maintain, and refine incident response playbooks, standard operating procedures, and runbooks based on lessons learned, threat intelligence, and industry best practices.
Thoroughly document incident-handling actions, findings, and decisions in the SOC ticketing system and prepare reports for management.
Guide, train, and mentor Tier 1 and Tier 2 analysts on incident handling, analysis techniques, tools, and OT security concepts.
Participate in training sessions and simulations to stay current on cyber threats, OT security practices, and monitoring tools.
Stay current on NERC-CIP standards, particularly requirements 2 and 3, NIST CSF, the Client Model for Industrial Control Systems, ISO 27001, and other relevant OT security regulations.
Meet or exceed SOC SLAs and project timelines, budgets, and deliverable objectives; work with business units to improve communication and efficiency.