Threat Intelligence & SOAR Engineer

We are seeking a highly skilled Threat Intelligence & SOAR Specialist to strengthen our cybersecurity operations by integrating threat intelligence platforms, automating incident response, and proactively identifying emerging threats. The ideal candidate will work closely with SOC and Incident Response teams to enhance detection, response, and threat visibility across enterprise environments.

Key Responsibilities:

• Integrate and manage multiple Threat Intelligence Platforms (TIPs) to centralize, correlate, and operationalize threat intelligence feeds.
• Configure, maintain, and optimize SOAR playbooks to automate incident response and security workflows.
• Enrich SIEM and XDR alerts using threat intelligence to improve detection accuracy, prioritization, and triage efficiency.
• Conduct proactive threat hunting across endpoint, network, and cloud environments to identify advanced and emerging threats.
• Collaborate with SOC and Incident Response teams to manage phishing campaigns, malware outbreaks, and Advanced Persistent Threat (APT) investigations.
• Maintain and enhance threat intelligence dashboards and reporting frameworks.
• Deliver monthly and ad-hoc threat intelligence reports to technical and business stakeholders.
• Continuously evaluate new threat intelligence sources and detection techniques to improve security posture.

Required Experience & Skills:

• 3+ years of hands-on experience in Threat Intelligence, SOAR, SOC operations, or Incident Response.
• Strong experience with Threat Intelligence and SOAR tools, including:
  • ThreatQuotient TIP
  • Palo Alto Cortex XSOAR
  • MISP
  • Anomali ThreatStream
• Solid understanding of MITRE ATT&CK framework, kill chains, and adversary tactics, techniques, and procedures (TTPs).
• Experience integrating TIPs with SIEM/XDR platforms.
• Proven ability to design and automate SOAR playbooks for real-world security incidents.
• Strong analytical, documentation, and communication skills.

Preferred Qualifications:

• Experience in banking, financial services, or large enterprise environments.
• Familiarity with phishing analysis, malware analysis, and threat actor profiling.
• Relevant cybersecurity certifications (e.g., GCIA, GCTI, GCED, CISSP, or vendor-specific certifications) are a plus.

Location: Riyadh, Saudi Arabia
Work Conditions: On-site, Full-time