About the Role
You will play a critical role in maintaining the security operations by managing alerts, conducting investigations, and implementing incident response processes. This position involves collaboration across various departments and with third-party SOC providers, ensuring the integrity and security of our systems while contributing to a culture of continuous improvement and knowledge sharing.
Ready to apply for roles like this?
Unlock the company name and direct application link. Subscribers get instant access to fresh jobs across Dubai, Abu Dhabi and Riyadh, many with visa support.
Unlock employer & apply directly
Security Operations Monitoring:
- Manage the investigation of alerts raised to identify security incidents. Close false positive alerts after triage.
- Analyze security events to identify threats and recommend actions.
- Manage the implementation of security controls and incident response processes.
- Contribute to team training and knowledge-sharing initiatives.
- Lead 24/7 security operations and respond to incidents.
- Document a daily update for all alerts investigated and their outcome, providing this update to the Head of Cyber by 7 PM.
- Document triage reports for all alerts that have been investigated.
- Lead the identification, prioritization, and implementation of use cases.
- Work with other departments to ensure logs for all servers and network devices are integrated with the SIEM.
- Manage operational relationships with third-party SOC providers.
- Ensure SLAs are met for identifying and investigating alerts.
Threat Hunting:
- Support the threat hunting lead to conduct threat hunts based on intelligence received from various sources.
- Review and produce threat hunting reports along with actionable recommendations.
- Oversee the continuous improvement of current threat hunting procedures.
Security Investigations and Incident Response:
- Support the cyber team in investigating cyber breaches, which includes:
- Investigating via an EDR platform.
- Conducting log analysis.
- Forensically imaging systems identified as being compromised.
- Analyzing any data collected during investigations.
- Providing recommendations on gaps identified during investigations.
- Ensure the chain of custody is maintained throughout investigations.
- Follow the incident management plan throughout the lifecycle of an incident response.
- Review, approve, and present investigation findings and post-incident reports to management and relevant stakeholders.
