Blue Team Resource

VaporVM; Dubai; On-site; AED 240,000 - 360,000; Full time

Job summary

VaporVM is seeking an experienced Blue Team Resource to strengthen defensive security operations by monitoring, detecting, investigating, and responding to cybersecurity threats. The role emphasizes hands-on experience in SOC operations, threat detection, incident response, threat hunting, SIEM, EDR/XDR, and security monitoring.

The successful candidate will monitor and analyze security events across SIEM/EDR/NDR, investigate alerts, perform threat hunting, and contribute to detection

Qualifications

• 4-7 years of hands-on experience in Blue Team, SOC, Cyber Defense, Threat Detection or Incident Response.
• Experience with SIEM platforms (Microsoft Sentinel, Splunk, QRadar or similar).
• Hands-on experience with EDR/XDR solutions (Microsoft Defender, CrowdStrike, SentinelOne or similar).
• Strong understanding of network security, Windows/Linux security, Active Directory, authentication, and enterprise infra.
• Experience with Threat Hunting and Incident Response.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain, IOC analysis, TTPs, and detection engineering.
• Experience analyzing Windows Event Logs, Sysmon, firewall logs, DNS, proxy, authentication, and endpoint telemetry.
• Knowledge of network traffic analysis and tools such as Wireshark.
• Familiarity with scripting languages (Python, PowerShell, Bash).
• Strong analytical, troubleshooting, documentation, and communication skills.

Responsibilities

• Monitor and analyze security events across SIEM, EDR/XDR, NDR, firewalls, WAF, IDS/IPS, and other controls.
• Investigate and respond to security alerts, incidents, and potential threats.
• Perform threat hunting to identify indicators of compromise and advanced threats.
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
• Analyze logs, network traffic, endpoint telemetry to identify malicious activity.
• Develop and optimize detection rules, correlations, use cases, dashboards and alerts.
• Map detected threats to the MITRE ATT&CK framework.
• Perform root cause analysis for incidents and provide remediation recommendations.
• Investigate malware, phishing, credential compromise, lateral movement, privilege escalation.
• Monitor alerts from EDR/XDR platforms and distinguish false positives.
• Collaborate with Red Team, vulnerability management, infra, and app security teams to improve controls.
• Support security incident response exercises and threat simulations.
• Maintain detailed documentation of incidents, investigations, and actions.
• Prepare security reports and operational metrics for technical and management audiences.
• Continuously improve SOC processes and monitoring coverage.

Skills

4-7 years experience

SIEM platforms

EDR/XDR solutions

Network and OS security

Threat Hunting

MITRE ATT&CK

Log analysis

Wireshark

Scripting (Python/PowerShell/Bash)

Analytical & communication skills

Education

GCIA

GCIH

GCED

Security+

CySA+

SC-200

BTLO

CEH

CISSP

Other blue team/IR certs

Job description

VaporVM is looking for an experienced Blue Team Resource to strengthen defensive security operations by monitoring, detecting, investigating, and responding to cybersecurity threats. The ideal candidate should have strong hands‑on experience in SOC operations, threat detection, incident response, threat hunting, SIEM, EDR/XDR, and security monitoring.

Key Responsibilities

• Monitor and analyze security events across SIEM, EDR/XDR, NDR, firewalls, WAF, IDS/IPS, and other security controls.
• Investigate and respond to security alerts, incidents, and potential threats.
• Perform threat hunting to proactively identify indicators of compromise, suspicious activities, and advanced threats.
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
• Analyze logs, network traffic, endpoint telemetry, and security events to identify malicious activity.
• Develop and optimize detection rules, correlation rules, use cases, dashboards, and alerts.
• Map detected threats and attack techniques to the MITRE ATT&CK framework.
• Perform root cause analysis (RCA) for security incidents and provide recommendations to prevent recurrence.
• Investigate malware, phishing, credential compromise, lateral movement, privilege escalation, and other attack activities.
• Monitor and investigate alerts from EDR/XDR platforms and distinguish false positives from genuine security incidents.
• Collaborate with Red Team, vulnerability management, infrastructure, and application security teams to improve defensive controls.
• Support security incident response exercises and threat simulation activities.
• Maintain detailed documentation of incidents, investigations, findings, and remediation actions.
• Prepare security reports, incident summaries, and operational metrics for technical and management stakeholders.
• Continuously improve SOC processes, detection capabilities, monitoring coverage, and incident response procedures.

Required Skills

• 4 7 years of hands‑on experience in Blue Team, SOC, Cyber Defense, Threat Detection, or Incident Response.
• Strong experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or similar.
• Hands‑on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike, SentinelOne, or similar.
• Strong understanding of network security, Windows/Linux security, Active Directory, authentication, and enterprise infrastructure.
• Experience with Threat Hunting and Incident Response.
• Strong knowledge of MITRE ATT&CK, Cyber Kill Chain, IOC analysis, TTPs, and detection engineering.
• Experience analyzing Windows Event Logs, Sysmon, firewall logs, DNS, proxy, authentication, and endpoint telemetry.
• Knowledge of network traffic analysis and packet analysis tools such as Wireshark.
• Familiarity with Python, PowerShell, Bash, or other scripting languages is an advantage.
• Strong analytical, troubleshooting, documentation, and communication skills.

Certifications

Relevant certifications are preferred, such as:

• GCIA / GCIH / GCED
• Security+
• CySA+
• SC-200
• BTLO
• CEH
• CISSP
• Other relevant Blue Team, SOC, or Incident Response certifications.

Preferred Profile

A hands‑on cybersecurity professional specializing in Blue Team operations, SOC, Threat Hunting, Incident Response, SIEM, EDR/XDR, and Detection Engineering, with the ability to investigate sophisticated threats and continuously strengthen an organization s defensive security posture.

Desired Candidate Profile

A hands‑on cybersecurity professional specializing in Blue Team operations, SOC, Threat Hunting, Incident Response, SIEM, EDR/XDR, and Detection Engineering, with the ability to investigate sophisticated threats and continuously strengthen an organization s defensive security posture.