CSOC Operational Engineer - Level 2

Emirates Airlines - Other locations; Abu Dhabi; On-site; AED 240,000 - 420,000; Full time

Benefits offered by this job

Travel benefits

Tax-free salary

Job summary

Emirates Airlines is seeking a CSOC Operational Engineer - Level 2 to join our cybersecurity team. You will monitor threats, investigate complex incidents, and guide Level 1 engineers while validating AI- and automation-supported findings.

You will coordinate with escalation specialists to ensure timely, controlled incident resolution. The role requires 3+ years in cybersecurity operations and a GIAC-certified incident handler (GCIH) or equivalent.

Qualifications

• Degree in Information Technology or related field; 3+ years in Cybersecurity Operations.
• GCIH or equivalent certification.

Responsibilities

• Monitor threats, incidents and control performance; analyze and investigate complex events.
• Provide guidance to Level 1 engineers and validate AI/automation-assisted findings.
• Ensure timely incident resolution within SLAs and maintain auditable documentation.
• Review and improve incident triage, escalation, and handovers; maintain procedures and automation playbooks.
• Communicate findings clearly to technical and non-technical stakeholders.

Skills

CSOC detection

Incident response

Operational workflows

Security platforms

Infrastructure security

Cloud security

Threat monitoring

AI/automation safety

Stakeholder communication

Education

Degree in Information Technology or related field

GIAC Certified Incident Handler (GCIH)

Tools

SIEM platforms

Automation/AI decision-support tools

Job description

Job description

Job Purpose

At Emirates, we believe in connecting the world, to and through, our global hub in Dubai; and in constantly innovating to ensure our customers 'Fly Better'.

Join our Cybersecurity team, where we strive to maintain a world-class cybersecurity organisation built on the key principles of People, Process, and Technology, underpinned by executive endorsement of a multi-year strategy for continuous improvement and development. The team protects our digital assets by monitoring threats, responding to incidents, managing vulnerabilities, and ensuring compliance with security policies and regulations.

The CSOC Operational Engineer - Level 2 will perform advanced cybersecurity monitoring, analysis, and investigations to identify and resolve complex security incidents, threats and control issues. Provide technical guidance to Level 1 engineers, validate AI- and automation-supported findings and response actions, and coordinate with escalation specialists to ensure effective, timely and well-controlled incident resolution.

In this role, you will:

• Guide Level 1 engineers and the decision support system to ensure correct diagnosis and effective use of approved AI and automation.
• Ensure timely resolution and fulfilment of escalated incidents, service requests and control issues within applicable SLAs.
• Maintain clear, accurate and auditable documentation, operational logs and effective handovers for complex incidents, service requests and control decisions.
• Monitor threat, vulnerability, service-health and control-performance information using approved analytical and automated capabilities; assess business and operational impact and initiate proportionate action.
• Perform detailed analysis of cyber threats, incidents, control failures and identity-related risks; validate AI- or automation-assisted findings and recommend preventative or corrective actions.
• Review operational triage and control-handling activities performed by Level 1 engineers or approved automation, ensuring accurate closure or escalation.
• Create and maintain operational procedures, automation playbooks, knowledge-base content and approved automation workflows, incorporating lessons from incidents and service issues.

Qualification

To be considered for this role, you must meet the below requirements:

• Degree or Honours (12+3 or equivalent) in Information Technology and 3+ years of Cybersecurity Operations experience.
• GIAC Certified Incident Handler (GCIH) or equivalent certification.

Knowledge/Skills

Knowledge/Skills:

• Advanced knowledge of CSOC detection, monitoring, incident response and operational workflows.

• Strong working knowledge of the enterprise security platforms used for detection and response, including their capabilities, data sources, workflows and limitations, to support effective monitoring, investigation and incident handling.

• Knowledge of infrastructure, cloud, endpoint, server, operating-system and network security controls relevant to monitoring and response.

• Knowledge of protocol, web-service and database security concepts and their relevance to security operations.

• Practical knowledge of defence-in-depth, zero-trust and operational-resilience principles, including security queries, basic scripting and approved automation or AI decision-support systems.

• Analyse security events and operational evidence to identify threats, determine impact and recommend appropriate action.

• Triage and prioritise alerts and incidents according to risk, urgency and operational impact.

• Make timely decisions within delegated authority and**escalate** incidents to the appropriate response or resolver team.

• Apply safe, responsible and governed use of approved AI and automation tools within the role, protecting sensitive data, applying human oversight, validating outputs and complying with applicable policies and controls.

• Communicate security findings and operational updates clearly through accurate written and verbal reporting for technical and non-technical stakeholders.

Leadership Role: No.

Salary & benefits

Join us in Dubai and enjoy an attractive tax-free salary and travel benefits that are exclusive to our industry, including discounts on flights and hotels stays around the world. Find out what it's like to live and work in our fast-paced, cosmopolitan home city in the Dubai Lifestyle section of our website www.emirates.com/careers.