Senior Security Operations Engineer

• Design and operate security operations across cloud, identity, endpoint and SaaS
• Build threat detection, threat hunting and incident response capabilities
• Design and build pipelines bringing logs from cloud, identity, endpoint and SaaS sources into the SIEM or security data lake
• Normalize and enrich data at ingestion
• Monitor pipeline health and detect broken log sources quickly
• Balance security coverage against cost and retention requirements
• Select, deploy, configure and tune SIEM, EDR, cloud threat detection and automation tooling
• Configure tooling to raise alerts with a high signal-to-noise ratio
• Write detections as code and map them to MITRE ATT&CK
• Measure and test detection coverage and prioritize effort based on risk
• Own the incident response plan and playbooks
• Act as incident commander for security events
• Coordinate containment and recovery across engineering, legal and leadership
• Run blameless post-incident reviews that strengthen the organization
• Work closely with engineering and Product Security to protect the cloud-native platform
• Shape and build security operations from first principles as the first Security Operations hire

• Typically 5+ years in security operations, detection engineering or incident response, with hands-on experience building things yourself
• A startup or scale-up background is a strong plus
• Hands-on experience building detections and investigating incidents in AWS, using CloudTrail, GuardDuty, VPC Flow Logs and Kubernetes audit logs
• Lead experience in detection engineering and detection-as-code, incident response and cloud forensics, SIEM and security data pipeline architecture, security automation (SOAR) and alert triage workflows, or threat hunting and threat intelligence
• Ability to write code using Python, SQL or the SIEM’s query language
• Ability to treat detections and runbooks like software and automate repetitive work
• Ability to run an incident and keep stakeholders informed under pressure
• Ability to communicate technical findings as statements of impact and next steps for engineers, leadership, non-technical colleagues and customers when needed
• Experience building incident response and logging controls for SOC 2, ISO 27001 or PCI audits is a plus
• Experience managing an MDR or MSSP partner is a plus
• Familiarity with breach notification obligations, such as UAE PDPL and customer contractual SLAs, is a plus
• Experience hiring or mentoring security analysts or engineers as a function grows is a plus

• Immediate, large-scale impact on a high-growth business
• Top-of-the-market compensation packages
• Work alongside top regional talent, with team members from Talabat, Careem, Etisalat, and more