CSOC Operational Engineer - Level 2

The Emirates Group; Dubai; On-site; AED 180,000 - 260,000; Full time

Job summary

The Emirates Group seeks a CSOC Operational Engineer - Level 2 to perform advanced monitoring, analysis and investigations to identify and resolve complex security incidents, threats and control issues. You will guide Level 1 engineers and validate AI- and automation-supported findings and responses for timely resolution.

Responsibilities include threat analysis, reviewing triage, creating automation playbooks, maintaining auditable logs and clear security updates for technical and business

Qualifications

• Degree in Information Technology.
• 3+ years of Cybersecurity Operations experience.
• GIAC Certified Incident Handler (GCIH) or equivalent certification.

Responsibilities

• Guide Level 1 engineers and the decision support system to ensure correct diagnosis and effective use of approved AI and automation.
• Ensure timely resolution and fulfilment of escalated incidents, service requests and control issues within applicable SLAs.
• Maintain clear, accurate and auditable documentation, operational logs and effective handovers for complex incidents, service requests and control decisions.
• Monitor threat, vulnerability, service-health and control-performance information using approved analytical and automated capabilities; assess business and operational impact and initiate proportionate action.
• Perform detailed analysis of cyber threats, incidents, control failures and identity-related risks; validate AI- or automation-assisted findings and recommend preventative or corrective actions.
• Review operational triage and control-handling activities performed by Level 1 engineers or approved automation, ensuring accurate closure or escalation.
• Create and maintain operational procedures, automation playbooks, knowledge-base content and approved automation workflows, incorporating lessons from incidents and service issues.

Skills

Cybersecurity operations

Incident response

Threat analysis

Guiding Level 1 engineers

Education

Degree in Information Technology

Job description

The CSOC Operational Engineer - L evel 2 will perform advanced cybersecurity monitoring, analysis, and investigations to identify and resolve complex security incidents, threats and control issues. Provide technical guidance to Level 1 engineers, validate AI- and automation-supported findings and response actions, and coordinate with escalation specialists to ensure effective, timely and well-controlled incident resolution.

In this role, you will:

• Guide Level 1 engineers and the decision support system to ensure correct diagnosis and effective use of approved AI and automation.
• Ensure timely resolution and fulfilment of escalated incidents, service requests and control issues within applicable SLAs.
• Maintain clear, accurate and auditable documentation, operational logs and effective handovers for complex incidents, service requests and control decisions.
• Monitor threat, vulnerability, service-health and control-performance information using approved analytical and automated capabilities; assess business and operational impact and initiate proportionate action.
• Perform detailed analysis of cyber threats, incidents, control failures and identity-related risks; validate AI- or automation-assisted findings and recommend preventative or corrective actions.
• Review operational triage and control-handling activities performed by Level 1 engineers or approved automation, ensuring accurate closure or escalation.
• Create and maintain operational procedures, automation playbooks, knowledge-base content and approved automation workflows, incorporating lessons from incidents and service issues.

Qualification

To be considered for this role, you must meet the below requirements:

• Degree or Honours (12+3 or equivalent) in Information Technology and 3+ years of Cybersecurity Operations experience.
• GIAC Certified Incident Handler (GCIH) or equivalent certification.

Knowledge/Skills:

• Advanced knowledge of CSOC detection, monitoring, incident response and operational workflows.
• Strong working knowledge of the enterprise security platforms used for detection and response, including their capabilities, data sources, workflows and limitations, to support effective monitoring, investigation and incident handling.
• Knowledge of infrastructure, cloud, endpoint, server, operating-system and network security controls relevant to monitoring and response.
• Knowledge of protocol, web-service and database security concepts and their relevance to security operations.
• Practical knowledge of defence-in-depth, zero-trust and operational-resilience principles, including security queries, basic scripting and approved automation or AI decision-support systems.
• Analyse security events and operational evidence to identify threats, determine impact and recommend appropriate action.
• Triage and prioritise alerts and incidents according to risk, urgency and operational impact.
• Make timely decisions within delegated authority and escape incidents to the appropriate response or resolver team.

Desired Candidate Profile

• Degree or Honours (12+3 or equivalent) in Information Technology and 3+ years of Cybersecurity Operations experience.
• GIAC Certified Incident Handler (GCIH) or equivalent certification.

Knowledge/Skills:

• Advanced knowledge of CSOC detection, monitoring, incident response and operational workflows.
• Strong working knowledge of the enterprise security platforms used for detection and response, including their capabilities, data sources, workflows and limitations, to support effective monitoring, investigation and incident handling.
• Knowledge of infrastructure, cloud, endpoint, server, operating-system and network security controls relevant to monitoring and response.
• Knowledge of protocol, web-service and database security concepts and their relevance to security operations.
• Practical knowledge of defence-in-depth, zero-trust and operational-resilience principles, including security queries, basic scripting and approved automation or AI decision-support systems.
• Analyse security events and operational evidence to identify threats, determine impact and recommend appropriate action.
• Triage and prioritise alerts and incidents according to risk, urgency and operational impact.
• Make timely decisions within delegated authority and escape incidents to the appropriate response or resolver team.
• Apply safe, responsible and governed use of approved AI and automation tools within the role, protecting sensitive data, applying human oversight, validating outputs and complying with applicable policies and controls.
• Communicate security findings and operational updates clearly through accurate written and verbal reporting for technical and non-technical stakeholders.