Cybersecurity Monitoring Lead for HVDC/FACTS

A Snapshot of Your Day

Join GT SV in Bucharest to help develop cybersecurity monitoring services for HVDC and FACTS stations within Grid Technologies Service. Imagine leading a team of analysts on the front line, monitoring, detecting, and responding to threats across both enterprise IT and industrial (OT) environments ??? from servers, endpoints, and networks through to the ICS, PLCs, DCS, and SCADA systems that keep HVDC and FACTS stations running. You will work with central function CYS, central SOC, central Incident manage, interface with central function, define how it runs day to day, and act as the bridge between SOC operations, OT engineering, and incident response teams, ensuring incidents are caught early and managed effectively while preserving operational continuity and safety. Your leadership will be vital in building resilience, maturing detection capabilities, and growing the team.

How You'll Make an Impact

• Develop the implementation concept and operational readiness of cybersecurity monitoring capability in the Bucharest office for HVDC/FACTS stations within GT SV Service engagements. Define the customer IT and OT coverage and delivery interfaces jointly with CYS and the central CYS SOC before commencing operations.
• Develop the skills and knowledge required for the GT SV monitoring service, mentor colleagues, and contribute to resource planning, training, and continuous improvement. Define staffing, shift coverage, and on-call requirements with the responsible line managers and CYS within the agreed service delivery model.
• Align service procedures with the applicable central cybersecurity processes rather than defining a separate enterprise SOC operating model.
• Act as the GT SV technical escalation contact for incidents affecting systems within the agreed HVDC/FACTS customer-service scope. Support triage and investigation with the designated incident response lead, CYS, the central CYS SOC, and customer IT/OT teams.
• Direct the design and optimization of detection strategies across SIEM (Splunk), EDR/XDR, NDR, and specialized OT/ICS monitoring technologies to maximize visibility across hybrid environments.
• Align architecture, platform selection, integrations, and deployment decisions with CYS and the relevant platform owners
• Oversee the development, validation, and continuous enhancement of detection content - correlation rules, analytics, threat hunting methodologies, and response playbooks - for both IT and industrial threats in the area of responsibility.
• Contribute HVDC/FACTS and service-specific expertise to incident response planning and major incident investigations within the agreed customer-service scope. Support the designated incident response lead with containment options and recommendations for long-term risk reduction, coordinating with CYS, engineering teams.
• Establish monitoring baselines, maturity metrics, KPIs, and SLAs for the GT SV (HVDC/FACTS) scope, and report on SOC performance, risk posture, and improvement initiatives to management and stakeholders.
• Contribute customer and HVDC/FACTS service requirements to security strategy discussions, ensure compliance with central CYS requirments.
• Ensure SOC operations align with internal requirements as well as with relevant frameworks and regulations, including IEC 62443, NIST CSF, ISO 27001, and NIS2.

What You Bring

• 5+ years of cybersecurity experience, including significant hands-on experience in Security Operations Centers (SOC), Incident Response, Detection Engineering, or Threat Hunting, with at least 2-3 years in a lead or team management capacity.
• Proven experience building, standing up, or operationalizing SOC capabilities, ideally spanning both enterprise IT and OT/industrial or critical infrastructure environments (energy, utilities, grid, or similar).
• Strong IT security foundation, including endpoint, network, identity, and infrastructure security, with the ability to lead detection and response across a broad enterprise attack surface (the primary focus of the role).
• Solid understanding of ICS/OT architectures and industrial processes, including working knowledge of PLC, HMI, SCADA, DCS, and industrial networking - experience with HVDC/FACTS, power transmission, or grid environments is a strong advantage.
• Familiarity with industrial communication protocols such as Modbus, PROFINET, DNP3, IEC 60870-5-104, OPC UA, and EtherNet/IP.
• Advanced knowledge of SIEM, EDR/XDR, NDR, and security monitoring technologies, including use case development, correlation rule creation, and detection tuning. Hands-on experience with Splunk is strongly preferred, as it will be the primary SIEM platform.
• Experience leading incident response activities, investigations, and forensic analysis while balancing cybersecurity objectives with operational and safety requirements.
• Strong understanding of cybersecurity frameworks and standards, including IEC 62443, NIST CSF, ISO 27001, NIS2, and relevant industry regulations.
• Demonstrated people-leadership skills: building teams, mentoring analysts, driving SOC maturity, and leading process improvement and knowledge development initiatives.
• Excellent stakeholder management and communication skills, with the ability to work effectively across cybersecurity, engineering, automation, operations, and client-facing teams.
• Ability to translate threat intelligence into actionable detection and response capabilities across both IT and industrial environments.
• Fluent English; German is a plus. Willingness to travel internationally on occasion.

About the Team

Our Grid Technology division enables a reliable, sustainable, and digital grid. Siemens Energy offers an outstanding range and solutions in HVDC transmission, grid stabilization and storage, high voltage switchgears and transformers, and technology related to digital grid technology.

Who is Siemens Energy?

At Siemens Energy, we are more than just an energy technology company. We meet the growing energy demand across 90+ countries while ensuring our climate is protected. With 100,000 dedicated employees, we not only generate electricity for over 16% of the global community, but we're also using our technology to help protect people and the environment.

Our cross-border team is committed to making sustainable, reliable, and affordable energy a reality by pushing the boundaries of what is possible. We uphold a 150-year legacy of innovation that encourages our search for people who will support our focus on decarbonization, new technologies, and energy transformation.

Find out how you can make a difference at Siemens Energy: https://www.siemens-energy.com/employeevideo

Our Office

Siemens Energy's location in One Cotroceni Park is more than just an office space - it's a hub for a vibrant and growing community. Nestled in the heart of Bucharest, this urban development is the perfect place to work, surrounded by green spaces, shopping destinations, and everything the city center has to offer. And with the Academia Militara subway station just a 3-minute walk away, getting around the city has never been easier.

Our Commitment to Diversity

Lucky for us, we are not all the same. Through diversity, we generate power. We run on inclusion and our combined creative energy is motivated by over 130 nationalities. Siemens Energy celebrates character ??? no matter what ethnic background, gender, age, religion, identity, or disability. We energize society, all of society, and we do not discriminate based on our differences.

Rewards/ Benefits

• Your lunch with SE meal tickets
• Keep your brain fit with our trainings
• Special for books lovers - Bookster
• Stay safe and healthy with our medical subscription
• Think about your future too with Private Pension Pilon III
• Look after yourself with our Wellbeing Initiatives

#LI-CG1

#LI-Hybrid