Security Analyst

About Core42

Opportunity

Key responsibilities

• Monitor Splunk alerts, triage and investigate events, make incident decisions, and escalate or guide analysts.
• Investigate EDR/NDR threats and own incidents through containment, eradication, recovery, and review.
• Coordinate response across platform, infrastructure, network, and application teams; maintain playbooks and SOPs.
• Build and tune Splunk searches, alerts, dashboards, reports, and SPL queries; reduce false positives and alert fatigue.
• Onboard log sources, validate parsing and data quality, and manage Cribl routing, filtering, enrichment, and normalization pipelines.
• Conduct threat hunts, map detection coverage to MITRE ATT&CK, identify gaps, and create durable detections.
• Apply threat intelligence and frameworks; identify indicators and patterns to prevent recurrence.
• Produce root cause analysis and incident reports; maintain case records and evidence; support continuous improvement and audit needs.
• Work rotational day, evening, and night shifts, including weekends and public holidays; meet SLAs and complete structured handovers.

Required qualifications

• Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or related field; equivalent professional experience and certifications are accepted instead.
• 5–8 years in security operations, incident response, or SOC monitoring, including at least 2 years at senior level.
• Hands-on Splunk Enterprise or Cloud expertise: advanced SPL, dashboards, correlation searches, alert creation and tuning, and administration.
• Cribl Stream or Edge experience in log routing, parsing, filtering, enrichment, and pipeline management.
• Strong incident investigation, evidence handling, escalation, full-lifecycle response, playbook/SOP development, and RCA skills.
• Experience with Elastic Security EDR and Corelight NDR; knowledge of MITRE ATT&CK, Cyber Kill Chain, and Diamond Model.
• Networking knowledge covering TCP/IP, DNS, HTTP/S, firewalls, proxies, and IDS/IPS; proficiency in Windows and Linux.
• Python, Bash, or PowerShell proficiency; familiarity with OpenShift, OpenStack, Commvault, Scality, or related platform logs.
• Experience with ServiceNow, Jira, or equivalent ticketing and case management.

Preferred qualifications

• Splunk Core Certified Power User or Splunk Certified Admin; Cribl Certified Admin; relevant GIAC certifications such as GCIA, GCIH, GCDA, or GCFA; BTL2 or equivalent defensive certification.
• Experience monitoring OpenStack and Kubernetes/OpenShift environments; familiarity with detection-as-code, version control, and peer review.

Schedule

• Full-time work in a 24x7 SOC on rotational day, evening, and night shifts, including weekends and public holidays.
• Meet acknowledgement, triage, and escalation SLAs and complete structured handovers.

Compensation and benefits

• Competitive salary package based on skills and experience; performance-based yearly bonus.
• Benefits include Esaad and Fazaa discount cards, family health coverage including dental, vision, and life insurance, and learning platforms.