About the Job:
Ready to apply for roles like this?
Unlock the company name and direct application link. Subscribers get instant access to fresh jobs across Dubai, Abu Dhabi and Riyadh, many with visa support.
Unlock employer & apply directly
The Subject Matter Expert – Security Operations Center (SOC) oversees advanced security monitoring and incident management activities within the Cyber Security function. This role serves as the primary escalation point for complex or high-severity security incidents, providing technical leadership and validation before handover to Incident Response teams.
The SME leads deep-dive investigations using SIEM, IDS/IPS, firewalls, endpoint detection, and network telemetry, and applies frameworks such as MITRE ATT&CK and DEFEND to strengthen threat-hunting and detection coverage. Responsibilities include designing, tuning, and validating detection rules, developing and maintaining SOC playbooks and runbooks, and ensuring effective monitoring across hybrid infrastructures (on-prem, cloud, and telco cloud).
Additionally, the SME mentors SOC engineers, conducts trainings and technical workshops, drives automation opportunities (SOAR playbooks and workflows), and contributes to the continuous improvement of SOC processes and content. The role also involves monitoring threat intelligence, tracking emerging threats and vulnerabilities, and communicating findings through clear reports and presentations to security leadership and stakeholders.
Responsibilities:
- Serve as the primary contact for advanced security monitoring, threat detection, and investigation methodologies.
- Lead and supervise team members to ensure effective incident detection and response.
- Provide technical guidance and escalation support to SOC analysts for complex or high-severity incidents.
- Act as the final technical validation authority before escalating to Incident Response (IR) teams.
- Utilize the MITRE ATT&CK and DEFEND frameworks to map detected threats and enhance threat-hunting capabilities.
- Conduct deep-dive technical investigations for high-impact or ambiguous alerts.
- Identify gaps in detection coverage and recommend improvements.
- Develop and maintain SOC playbooks and runbooks for consistent investigation standards.
- Ensure effective detection and monitoring across hybrid environments.
- Mentor analysts and organize trainings to maintain team expertise.
- Monitor and analyze threat intelligence feeds, security blogs, and industry news to stay informed on emerging threats and vulnerabilities.
Qualifications:
-
Formal Education Required: Bachelor’s degree in Cybersecurity, Computer Science, or a related field (or equivalent work experience).
-
Years & Field Of Experience Required: 8–10 years.
Job-Specific Competencies:
- Team Lead experience.
- Deep experience in monitoring and interpreting SIEM outputs, including log correlation, alert triage, and threat prioritization.
- Ability to design, validate, and tune detection rules and alerts for multiple platforms (SIEM, EDR, NDR, IDS/IPS, firewalls).
- Experience with SIEM technologies such as Splunk, Microsoft Sentinel, etc.
- Strong knowledge of network protocols and the ability to identify malicious activity patterns.
- Awareness of the current threat landscape, malware trends, and attack vectors.
Location: Dubai, Dubai, United Arab Emirates
Work Conditions: Full-time, On-site
Language Requirements: Not specified.
