Lead SOC Analyst

Location and employment

• Onsite in Doha, Qatar.
• Full-time role with a 24/7 operational rota and on-call support.

About the role

Responsibilities

• Monitor Microsoft AI agents and platforms for compromise, privilege drift, prompt injection, data poisoning, unauthorized agents, and anomalous activity.
• Triage, investigate, and escalate incidents; carry out approved containment such as token revocation, Conditional Access enforcement, quarantine, and privilege restriction.
• Develop and tune Sentinel and Defender XDR detections, analytics rules, and monitoring content.
• Manage risk classifications, certifications, evidence, audit records, and compliance documentation; conduct assurance reviews and control testing.
• Track SLAs, KPIs, and KRIs; coordinate threat response with security, identity, governance, compliance, Microsoft support, and agent owners.
• Support threat hunting and monitoring improvements; maintain playbooks, incident procedures, and runbooks.
• Participate in 24/7 monitoring and on-call support.

Requirements

• Relevant bachelor's degree and 5+ years in SOC, security operations, MSSP, cyber defence, or incident response.
• Hands-on Microsoft Sentinel, Defender XDR, Purview, Entra ID, Conditional Access, CAE, and PIM experience.
• Experience investigating identity attacks, authorization issues, insider threats, and cloud security incidents; creating and maintaining detections and investigation workflows.
• Experience in cloud-native and Microsoft security monitoring and 24/7 security operations; strong KQL proficiency.
• Knowledge of RBAC, PAM, least privilege, identity governance, cloud security, threat detection, and incident response.
• Knowledge of Copilot Studio, Microsoft 365 Agents, Azure AI Foundry, and agent governance and lifecycle management.
• Familiarity with OWASP LLM/agentic security, MITRE ATLAS, and NIST AI RMF.
• Strong analytical, documentation, audit, reporting, communication, and stakeholder skills; able to prioritize and perform under pressure.