Senior Associate - SOC

About the role

SOC operations and incident response

• Lead SOC operations and continuous security monitoring; oversee SIEM, SOAR, EDR, and other security technologies.
• Ensure alerts are triaged, investigated, escalated, and closed; optimize use cases, correlation rules, detection logic, and alert thresholds.
• Prioritize detection use cases based on business risk and threat intelligence, and monitor SOC KPIs including MTTD, MTTA, MTTR, closure time, SLA compliance, and alert volumes.
• Lead critical and high-severity incident investigations; coordinate response with network, application, infrastructure, and other teams.
• Coordinate escalation, containment, eradication, and recovery; conduct post-incident reviews and incorporate lessons learned.
• Improve detection capabilities, identify monitoring and log-coverage gaps, and ensure critical logs are onboarded, retained, and monitored.
• Work with threat intelligence and threat hunting teams to develop detection use cases; liaise with Security Administration on technical SOC issues.

Governance and compliance

• Maintain SOC procedures, playbooks, escalation matrices, and operational documentation.
• Support regulatory, internal, and external audits and align SOC operations with applicable requirements, including ISO 27001, PCI DSS, and UAE regulations as applicable.
• Maintain evidence of monitoring, investigations, incident handling, and SLA performance.

Qualifications and experience

• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or a related field.
• 8+ years of cybersecurity or security operations experience, including relevant SOC leadership experience.
• Experience managing enterprise SOC operations and/or an MSSP.
• Strong SIEM, SOAR, and EDR/XDR experience.
• Strong understanding of network, endpoint, identity, and application security.

Required skills and credentials

• CISSP/CISM; GIAC certifications.
• Hands-on Splunk/XSOAR experience; Splunk, Palo Alto, Fortinet, or other relevant technology certifications are listed.
• Advanced administration and detection-engineering experience with Splunk Enterprise Security.
• Ability to operationalize cyber threat intelligence feeds and proactively hunt for hidden threats using frameworks such as MITRE ATT&CK.

Benefits and work environment

• The employer describes a modern work environment with some flexibility and a collaborative team.
• Compensation includes an annual bonus and additional benefits such as child education allowance and annual flight tickets where eligible.
• Health insurance coverage is provided.