Blue Team Security Engineer — Threat Hunting & IR

VaporVM; Dubai; On-site; AED 240,000 - 360,000; Full time

Job summary

VaporVM is seeking an experienced Blue Team Resource to strengthen defensive security operations by monitoring, detecting, investigating, and responding to cybersecurity threats. The role emphasizes hands-on experience in SOC operations, threat detection, incident response, threat hunting, SIEM, EDR/XDR, and security monitoring.

The successful candidate will monitor and analyze security events across SIEM/EDR/NDR, investigate alerts, perform threat hunting, and contribute to detection

Qualifications

• 4-7 years of hands-on experience in Blue Team, SOC, Cyber Defense, Threat Detection or Incident Response.
• Experience with SIEM platforms (Microsoft Sentinel, Splunk, QRadar or similar).
• Hands-on experience with EDR/XDR solutions (Microsoft Defender, CrowdStrike, SentinelOne or similar).
• Strong understanding of network security, Windows/Linux security, Active Directory, authentication, and enterprise infra.
• Experience with Threat Hunting and Incident Response.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain, IOC analysis, TTPs, and detection engineering.
• Experience analyzing Windows Event Logs, Sysmon, firewall logs, DNS, proxy, authentication, and endpoint telemetry.
• Knowledge of network traffic analysis and tools such as Wireshark.
• Familiarity with scripting languages (Python, PowerShell, Bash).
• Strong analytical, troubleshooting, documentation, and communication skills.

Responsibilities

• Monitor and analyze security events across SIEM, EDR/XDR, NDR, firewalls, WAF, IDS/IPS, and other controls.
• Investigate and respond to security alerts, incidents, and potential threats.
• Perform threat hunting to identify indicators of compromise and advanced threats.
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
• Analyze logs, network traffic, endpoint telemetry to identify malicious activity.
• Develop and optimize detection rules, correlations, use cases, dashboards and alerts.
• Map detected threats to the MITRE ATT&CK framework.
• Perform root cause analysis for incidents and provide remediation recommendations.
• Investigate malware, phishing, credential compromise, lateral movement, privilege escalation.
• Monitor alerts from EDR/XDR platforms and distinguish false positives.
• Collaborate with Red Team, vulnerability management, infra, and app security teams to improve controls.
• Support security incident response exercises and threat simulations.
• Maintain detailed documentation of incidents, investigations, and actions.
• Prepare security reports and operational metrics for technical and management audiences.
• Continuously improve SOC processes and monitoring coverage.

Skills

4-7 years experience

SIEM platforms

EDR/XDR solutions

Network and OS security

Threat Hunting

MITRE ATT&CK

Log analysis

Wireshark

Scripting (Python/PowerShell/Bash)

Analytical & communication skills

Education

GCIA

GCIH

GCED

Security+

CySA+

SC-200

BTLO

CEH

CISSP

Other blue team/IR certs

Job description

VaporVM is seeking an experienced Blue Team Resource to strengthen defensive security operations by monitoring, detecting, investigating, and responding to cybersecurity threats. The role emphasizes hands-on experience in SOC operations, threat detection, incident response, threat hunting, SIEM, EDR/XDR, and security monitoring.

The successful candidate will monitor and analyze security events across SIEM/EDR/NDR, investigate alerts, perform threat hunting, and contribute to detection