Blue Team Resource

VaporVM Ltd.; Dubai; On-site; AED 240,000 - 360,000; Full time

Job summary

VaporVM Ltd. in Dubai is seeking an experienced Blue Team Resource to strengthen defensive security operations, monitor, detect, investigate, and respond to cybersecurity threats using SIEM, EDR/XDR, and related controls.

You will conduct threat hunting, incident triage, and RCA, map threats to MITRE ATT&CK, develop detection rules, and work with cross-functional teams to improve defenses. The role requires 4–7 years of hands-on experience and strong analytical skills.

Qualifications

• 4–7 years of hands-on experience in Blue Team, SOC, Cyber Defense, Threat Detection, or Incident Response.
• Proficiency with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or similar.
• Hands-on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike, SentinelOne, or similar.
• Strong understanding of network security, Windows/Linux security, Active Directory, authentication, and enterprise infrastructure.
• Experience with Threat Hunting and Incident Response.
• Strong knowledge of MITRE ATT&CK, Cyber Kill Chain, IOC analysis, TTPs, and detection engineering.
• Experience analyzing Windows Event Logs, Sysmon, firewall logs, DNS, proxy, authentication, and endpoint telemetry.
• Knowledge of network traffic analysis and packet analysis tools such as Wireshark.
• Familiarity with Python, PowerShell, Bash, or other scripting languages is an advantage.
• Strong analytical, troubleshooting, documentation, and communication skills.

Responsibilities

• Monitor and analyze security events across SIEM, EDR/XDR, NDR, firewalls, WAF, IDS/IPS, and other security controls.
• Investigate and respond to security alerts, incidents, and potential threats.
• Perform threat hunting to proactively identify indicators of compromise, suspicious activities, and advanced threats.
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
• Analyze logs, network traffic, endpoint telemetry, and security events to identify malicious activity.
• Develop and optimize detection rules, correlation rules, use cases, dashboards, and alerts.
• Map detected threats and attack techniques to the MITRE ATT&CK framework.
• Perform root cause analysis (RCA) for security incidents and provide recommendations to prevent recurrence.
• Investigate malware, phishing, credential compromise, lateral movement, privilege escalation, and other attack activities.
• Monitor and investigate alerts from EDR/XDR platforms and distinguish false positives from genuine security incidents.
• Collaborate with Red Team, vulnerability management, infrastructure, and application security teams to improve defensive controls.
• Support security incident response exercises and threat simulation activities.
• Maintain detailed documentation of incidents, investigations, findings, and remediation actions.
• Prepare security reports, incident summaries, and operational metrics for technical and management stakeholders.
• Continuously improve SOC processes, detection capabilities, monitoring coverage, and incident response procedures.

Job description

VaporVM is looking for an experienced Blue Team Resource to strengthen defensive security operations by monitoring, detecting, investigating, and responding to cybersecurity threats. The ideal candidate should have strong hands-on experience in SOC operations, threat detection, incident response, threat hunting, SIEM, EDR/XDR, and security monitoring.

Key Responsibilities

• Monitor and analyze security events across SIEM, EDR/XDR, NDR, firewalls, WAF, IDS/IPS, and other security controls.
• Investigate and respond to security alerts, incidents, and potential threats.
• Perform threat hunting to proactively identify indicators of compromise, suspicious activities, and advanced threats.
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
• Analyze logs, network traffic, endpoint telemetry, and security events to identify malicious activity.
• Develop and optimize detection rules, correlation rules, use cases, dashboards, and alerts.
• Map detected threats and attack techniques to the MITRE ATT&CK framework.
• Perform root cause analysis (RCA) for security incidents and provide recommendations to prevent recurrence.
• Investigate malware, phishing, credential compromise, lateral movement, privilege escalation, and other attack activities.
• Monitor and investigate alerts from EDR/XDR platforms and distinguish false positives from genuine security incidents.
• Collaborate with Red Team, vulnerability management, infrastructure, and application security teams to improve defensive controls.
• Support security incident response exercises and threat simulation activities.
• Maintain detailed documentation of incidents, investigations, findings, and remediation actions.
• Prepare security reports, incident summaries, and operational metrics for technical and management stakeholders.
• Continuously improve SOC processes, detection capabilities, monitoring coverage, and incident response procedures.

Required Skills

• 4–7 years of hands-on experience in Blue Team, SOC, Cyber Defense, Threat Detection, or Incident Response.
• Strong experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or similar.
• Hands-on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike, SentinelOne, or similar.
• Strong understanding of network security, Windows/Linux security, Active Directory, authentication, and enterprise infrastructure.
• Experience with Threat Hunting and Incident Response.
• Strong knowledge of MITRE ATT&CK, Cyber Kill Chain, IOC analysis, TTPs, and detection engineering.
• Experience analyzing Windows Event Logs, Sysmon, firewall logs, DNS, proxy, authentication, and endpoint telemetry.
• Knowledge of network traffic analysis and packet analysis tools such as Wireshark.
• Familiarity with Python, PowerShell, Bash, or other scripting languages is an advantage.
• Strong analytical, troubleshooting, documentation, and communication skills.

Certifications

Relevant certifications are preferred, such as:

• GCIA / GCIH / GCED
• Security+
• CySA+
• SC-200
• BTLO
• CEH
• CISSP
• Other relevant Blue Team, SOC, or Incident Response certifications.

Preferred Profile

A hands-on cybersecurity professional specializing in Blue Team operations, SOC, Threat Hunting, Incident Response, SIEM, EDR/XDR, and Detection Engineering, with the ability to investigate sophisticated threats and continuously strengthen an organization’s defensive security posture.