About the Role
The L3 Data & Endpoint Security Engineer owns the end-to-end design, hardening and incident response of every SAMA-mandated Data- and Endpoint-Security control across a broad technology stack spanning data protection, endpoint defense, threat and vulnerability management, and visibility/analytics platforms. This role serves as the final escalation point for complex security incidents, leads architecture reviews, and ensures evidence alignment with SAMA CSF domains PRV-03 (Data Security) and DE-02 (Endpoint Protection).
In this position, you will design highly available clusters and pipelines, lead root-cause analysis for critical incidents, fine-tune policies across multiple platforms, and maintain compliance with regulatory frameworks. You will also play a key leadership role, mentoring L2 engineers, building run-books and simulations, and contributing to budget and roadmap planning for the security toolset.
This is a high-visibility role requiring deep technical expertise and the ability to interface directly with auditors, regulators and senior leadership, ensuring the organization's data and endpoint security posture meets stringent regulatory and business requirements.
Ready to apply for roles like this?
Unlock the company name and direct application link. Subscribers get instant access to fresh jobs across Dubai, Abu Dhabi and Riyadh, many with visa support.
Unlock employer & apply directly
Essential Job Functions
- Design highly-available DLP/DAM clusters, encryption key hierarchies and EDR telemetry pipelines
- Integrate all security platforms with SIEM (QRadar) and SOAR for automated response
- Lead P1/P2 incidents including data-loss breach, ransomware and insider misuse across the full tool set
- Perform deep packet and forensic analysis, and issue formal root-cause analysis reports with preventive actions
- Build and fine-tune ForcePoint DLP policies, Seclore rights templates, and Cortex detections to meet business and regulator SLAs
- Maintain classification and retention schemes per SAMA SecReg
- Map control operation to SAMA / NCA ECC evidence, prepare audit artefacts and lead regulator walkthroughs
- Conduct quarterly tool health and efficacy reviews, and drive remediation programmes
- Create run-books, tabletop exercises and lab simulations, and coach three L2 engineers
- Recommend budget and roadmap items including licensing, hardware and SaaS migration
Basic Qualifications
- Bachelor’s in Cybersecurity, IT or related field
- 7+ years specialized in data-security or endpoint-protection, with hands-on experience in ≥70% of the listed tool stack
- Past ownership of enterprise-grade DLP rollout and EDR containment playbooks
- Strong scripting/automation skills (Python/PowerShell/REST)
- Proven experience presenting to auditors and senior leadership
Other Qualifications
- CISSP, CISM, or GIAC (GCFA/GCED)
- Vendor certifications: ForcePoint DSSP, Imperva DSF, Trend Micro CPSE/XDR, Carbon Black PCED, Thales Certified Engineer, Tripwire TIPS
- ITIL v4, ISO 27001 Lead Auditor
