Chief Analyst - information Security

Roads and Transport Authority; Abu Dhabi; On-site; AED 180,000 - 300,000; Full time

Job summary

Roads and Transport Authority in Abu Dhabi is seeking an experienced SOC professional to lead security operations, oversee incident response, and drive improvements across SIEM/SOAR tooling. The role requires strong experience in enterprise security, risk management, and regulatory controls.

The successful candidate will coordinate with stakeholders, supervise SOC shifts, and ensure timely remediation of security incidents, while maintaining compliance with ISO 27001 and related standards.

Qualifications

• Bachelor's or master's degree in CS/IT.
• Certifications such as GCIH, GCIA, and other SIEM certifications are desirable.

Responsibilities

• Oversee SOC operations and monitor incident response in coordination with stakeholders.
• Act as Shift Lead, supervise SOC shift activities, and ensure proper handovers and SLAs.
• Analyze events from incident-response queue; administer SIEM/SOAR/UBA controls and tune use cases and dashboards.
• Lead testing of controls against ISO 27001 and other standards; verify remediation within SDLC/CI-CD.
• Produce incident reports and dashboards; share threat intelligence and track SOC KPIs.

Skills

GCIH

GCIA

SIEM Certification

Education

Bachelor's degree in Computer Science/Information Technology

Master's degree in Computer Science/Information Technology

Tools

Splunk

SIEM

Job description

Job description

Strategy

• Support the translation of business strategies into security initiatives and high-level solution options aligned with enterprise architecture (EA), including service/application-based security postures and secure SDLC/CI-CD touchpoints.
• Align policies and controls with regulatory requirements; plan control testing and drive remediation with stakeholders; define section-level requirements, policy touchpoints, and operating-model implications for changed/new services.
• Maintain risk and readiness assessments; define response scenarios and recommend preventive and corrective actions, informed by blue-team/red-team exercises and lessons learned.
• Lead periodic reviews of the information-security risk register and propose updates in coordination with stakeholders, ensuring identified risks are mitigated and audit observations are closed.
• Set technical standards and operating procedures to embed security-by-design across systems and services; review project/change designs against security and EA standards and issue actionable recommendations covering cloud/on-premises patterns and integration controls.
• Promote information-security awareness by preparing targeted materials and supporting focused sessions; research technology trends and automation (e.g., Security Operations Center Machine Learning use-cases) to inform roadmaps and awareness priorities.

Operations

• Supervise the operation of the Security Operations Center (SOC) and monitor the response operations to security incidents and systems security in coordination with all internal and external stakeholders.
• Act as Shift Lead or Operations Lead when required by overseeing SOC shift activities and ensuring proper handovers between shifts, monitoring team performance and task allocation,escalating critical incidents to management while coordinating response efforts, and ensuringadherence to SLAs, KPIs, and operational procedures throughout the shift.
• Support SOC operations by analyzing and triaging events from the incident-response queue;coordinate consistent responses, assist with administering SIEM/SOAR/UBA/VM controls, and update/tune use cases, dashboards, and content.
• Supervise the testing of controls against ISO 27001, ISR, and other standards; recommend and verify remediation, leveraging SDLC/CI-CD integration where applicable.
• Assist in capturing and resolving IT security service requests and incidents per priorities and SLAs; enhance ticket handling by defining SOC metrics/KPIs and tracking them on operational dashboards.
• Oversee the dissemination of threat intelligence from internal and external sources, including commercial Cyber Threat Intelligence (CTI) feeds (e.g., iSight, Looking Glass).
• Support in the investigation of malware and intrusion attempts; perform log analysis and produce incident reports; enhance detection content within security tools to improve investigative depth.
• Monitor security systems for anomalies and respond to potential events; prepare dashboards and presentations for stakeholders, including multi-tier SIEM/Splunk/data-lake views and KPI packs for security operations.

Product/Process Improvement

• Develop and maintain security policies, standards, procedures, SOPs, and playbooks to protect information assets; incorporate enhanced SOC use-cases, content standards, and data-engineering patterns for logging/telemetry.
• Track control effectiveness and compliance metrics, document lessons learned, and mentor junior staff on risk-assessment methodologies; produce audit artifacts and management reports; drive corrective actions.

Job Qualifications & Requirements

Education

• Bachelor's degree/ Master's degree in Computer Science/Information Technology

Experience

• 3+ Years in case of Master's degree (5+ years in case of Bachelor's Degree)

Qualification

• Certifications such as GCIH, GCIA,SIEM certifications