Contract Resource Support for Security Operations (L2)

VaporVM; Dubai; On-site; AED 180,000 - 320,000; Full time

Job summary

VaporVM Ltd. is seeking an experienced security engineer to monitor and respond to security events across SIEM, EDR and NDR platforms.

You will correlate logs from network, endpoints, cloud and applications to detect malicious activity and support post-incident analysis. The role involves triage, containment, eradication and recovery, with a focus on reducing false positives through alert tuning and developing robust detection logic.

Qualifications

• 4–7 years of experience in a similar role.
• Experience with security monitoring, incident response and forensics.
• Proficiency in log correlation across network, endpoint, cloud and applications.
• Ability to develop SIEM use cases and tune alerts to reduce false positives.
• Experience in malware analysis and reverse engineering, with tooling proficiency.

Responsibilities

• Monitor SIEM/EDR/NDR for suspicious activity and security events.
• Perform triage, investigation, containment, eradication and recovery of incidents.
• Correlate logs from network, endpoint, cloud and app sources to detect threats.
• Develop SIEM use cases and alert tuning to reduce false positives.
• Support digital forensics and post-incident analysis.

Skills

Security monitoring

Incident response

Triage & containment

Forensics

Threat hunting

Threat intelligence

Malware analysis

Reverse engineering

Regulatory reporting

Tools

SIEM

EDR

NDR

Sigma

Snort

YARA

Ghidra

IDA Pro

x64dbg

Cuckoo Sandbox

Job description

Job description

Security Monitoring amp Incident Response Monitor SIEM EDR NDR and other security tools for suspicious activity and security events Perform triage investigation containment eradication and recovery of security incidents Correlate logs from network endpoint cloud and application sources to detect malicious behaviour Develop and manage SIEM use cases and alert tuning to reduce false positives Support digital forensics and post-incident analysis Maintain incident documentation and reporting aligned with regulatory requirements Coordinate with internal teams and external stakeholders during security incidents Intrusion amp Threat Analysis Analyze network telemetry endpoint logs and threat feeds to identify intrusion attempts Correlate Indicators of Compromise IOCs and Tactics Techniques and Procedures TTPs with known threat actor campaigns Provide threat context attribution insights and intelligence support to investigations Develop detection logic using Sigma Snort YARA and custom scripts Conduct proactive threat hunting based on emerging intelligence Malware Analysis amp Reverse Engineering Perform static and dynamic malware analysis using tools such as Ghidra IDA Pro x64dbg and Cuckoo Sandbox Reverse engineer obfuscated binaries and scripts to identify payloads persistence techniques and command-and-control C2 infrastructure Develop YARA rules and behavioural signatures for malware detection Maintain a malware repository and contribute to detection engineering improvements Candidates should have 4 7 years of experience in a similar role.