CSOC Operational Engineer - Level 2

Emirates; Dubai; On-site; AED 200,000 - 400,000; Full time

Benefits offered by this job

Travel benefits

Flight discounts

Tax-free salary

Job summary

Emirates is seeking a CSOC Operational Engineer - Level 2 to monitor, analyze and investigate complex security incidents. You will guide Level 1 engineers, validate AI-assisted findings and coordinate with escalation teams to ensure timely incident resolution in Dubai.

The role focuses on advanced threat analysis, incident response, and maintaining robust security workflows, with emphasis on governance and documentation across the CSOC.

Qualifications

• Degree in Information Technology or equivalent with 3+ years in cybersecurity operations.
• GIAC Certified Incident Handler (GCIH) or equivalent certification.

Responsibilities

• Guide Level 1 engineers and the decision support system for correct diagnosis.
• Ensure timely resolution of escalated incidents and service requests within SLAs.
• Maintain auditable documentation and handovers for complex incidents.
• Monitor threat, vulnerability and control-performance information with automation.
• Analyze cyber threats and validate AI/automation findings for actions.
• Review Level 1 triage and automation activities for accurate closure.
• Create and maintain operational procedures, automation playbooks and knowledge base content.

Skills

CSOC operations

Threat analysis

Incident response

Automation tools

Education

Bachelor's degree in Information Technology

3+ years cybersecurity operations

Tools

SIEM

Endpoint security

Firewalls

Job description

Job Purpose

At Emirates, we believe in connecting the world, to and through, our global hub in Dubai; and in constantly innovating to ensure our customers 'Fly Better'. Join our Cybersecurity team, where we strive to maintain a world-class cybersecurity organisation built on the key principles of People, Process, and Technology, underpinned by executive endorsement of a multi-year strategy for continuous improvement and development. The team protects our digital assets by monitoring threats, responding to incidents, managing vulnerabilities, and ensuring compliance with security policies and regulations. The CSOC Operational Engineer - Level 2 will perform advanced cybersecurity monitoring, analysis, and investigations to identify and resolve complex security incidents, threats and control issues. Provide technical guidance to Level 1 engineers, validate AI and automation-supported findings and response actions, and coordinate with escalation specialists to ensure effective, timely and well-controlled incident resolution.

In This Role, You Will

• Guide Level 1 engineers and the decision support system to ensure correct diagnosis and effective use of approved AI and automation.
• Ensure timely resolution and fulfilment of escalated incidents, service requests and control issues within applicable SLAs.
• Maintain clear, accurate and auditable documentation, operational logs and effective handovers for complex incidents, service requests and control decisions.
• Monitor threat, vulnerability, service-health and control-performance information using approved analytical and automated capabilities; assess business and operational impact and initiate proportionate action.
• Perform detailed analysis of cyber threats, incidents, control failures and identity-related risks; validate AI or automation-assisted findings and recommend preventative or corrective actions.
• Review operational triage and control-handling activities performed by Level 1 engineers or approved automation, ensuring accurate closure or escalation.
• Create and maintain operational procedures, automation playbooks, knowledge-base content and approved automation workflows, incorporating lessons from incidents and service issues.

Qualification

To be considered for this role, you must meet the below requirements:

• Degree or Honours (12+3 or equivalent) in Information Technology and 3+ years of Cybersecurity Operations experience.
• GIAC Certified Incident Handler (GCIH) or equivalent certification.

Knowledge/Skills

• Advanced knowledge of CSOC detection, monitoring, incident response and operational workflows.
• Strong working knowledge of the enterprise security platforms used for detection and response, including their capabilities, data sources, workflows and limitations, to support effective monitoring, investigation and incident handling.
• Knowledge of infrastructure, cloud, endpoint, server, operating-system and network security controls relevant to monitoring and response.
• Knowledge of protocol, web-service and database security concepts and their relevance to security operations.
• Practical knowledge of defence-in-depth, zero-trust and operational-resilience principles, including security queries, basic scripting and approved automation or AI decision-support systems.
• Analyse security events and operational evidence to identify threats, determine impact and recommend appropriate action.
• Triage and prioritise alerts and incidents according to risk, urgency and operational impact.
• Make timely decisions within delegated authority and elevate incidents to the appropriate response or resolver team.
• Apply safe, responsible and governed use of approved AI and automation tools within the role, protecting sensitive data, applying human oversight, validating outputs and complying with applicable policies and controls.
• Communicate security findings and operational updates clearly through accurate written and verbal reporting for technical and non-technical stakeholders.

Leadership Role: No.

Salary & benefits

Join us in Dubai and enjoy an attractive tax-free salary and travel benefits that are exclusive to our industry, including discounts on flights and hotels stays around the world. Find out what it’s like to live and work in our fast-paced, cosmopolitan home city in the Dubai Lifestyle section of our website www.emirates.com/careers.

Requirements: