Cybersecurity Operations & Incident Response Lead

Remotedxb; Dubai; On-site; AED 380,000 - 620,000; Full time

Benefits offered by this job

Medical plans

Dental insurance

Vision insurance

Life insurance

Disability insurance

401(k) with company matching

Paid time off

Holidays

Job summary

Coastal is seeking a senior Security Operations leader in Dubai to own SIEM/SOAR strategy, manage daily operations, and drive incident response for high-severity events.

You will oversee vulnerability lifecycle across on-prem and cloud, and supervise SOC/MSSP partners while aligning SecOps to FFIEC/GLBA and NIST CSF. Strong leadership and cloud experience are required.

Qualifications

• 8+ years in Security Operations, Incident Response, Detection Engineering, or Threat Hunting.
• 3+ years of team leadership experience.
• Hands-on expertise with SIEM/SOAR, EDR, and detection content development.
• Experienced incident commander for high-impact events.
• Familiar with hybrid environments (Azure, Okta, M365, Zscaler).
• Knowledge of MITRE ATT&CK and threat-led validation.
• Proficiency with scripting or automation tools like Python or TypeScript.
• Bachelor's degree in Information Security, CS, or equivalent practical experience.

Responsibilities

• Own SIEM/SOAR strategy and daily operations including log onboarding and detection engineering.
• Serve as incident response commander for high-severity incidents and coordinate cross-functional responders.
• Manage the vulnerability management lifecycle across servers, endpoints, cloud, and APIs.
• Oversee third-party SOC/MSSP providers to ensure quality, SLAs, and continuous tuning.
• Align SecOps processes to FFIEC/GLBA and frameworks like NIST CSF.
• Develop and report on KPIs and KRIs for Security and Threat Operations.

Skills

Security operations

Incident response

Detection engineering

Team leadership

SIEM/SOAR

EDR

Automation scripting

MITRE ATT&CK

Azure / M365 / cloud

Education

Bachelor's degree in Information Security or CS

Tools

Python

TypeScript

Job description

Responsibilities

• Own SIEM/SOAR strategy and daily operations, including log onboarding and detection engineering
• Serve as incident response commander for high‑severity incidents and coordinate cross‑functional responders
• Manage the vulnerability management lifecycle across servers, endpoints, cloud, and APIs
• Oversee third‑party SOC/MSSP providers to ensure quality, SLAs, and continuous tuning
• Align SecOps processes to FFIEC/GLBA expectations and industry frameworks like NIST CSF
• Develop and report on KPIs and KRIs for the Security and Threat Operations function

Requirements

• 8+ years in Security Operations, Incident Response, Detection Engineering, or Threat Hunting
• 3+ years of team lead experience
• Hands‑on expertise with SIEM/SOAR, EDR, and detection content development
• Proven experience as an incident commander for high‑impact events
• Experience operating in hybrid environments (Azure, Okta, M365, Zscaler, etc.)
• Familiarity with MITRE ATT&CK and threat‑led validation
• Proficiency with scripting or automation tools like Python or TypeScript
• Bachelor's degree in Information Security, Computer Science, or equivalent practical experience

Preferred Qualifications

• Prior experience in a regulated environment such as finance or healthcare

Benefits

• Competitive medical plans and HSA options
• Dental and vision insurance
• Life, disability, and supplemental insurance
• 401(k) retirement plan with company matching
• Generous paid time off and 11 paid holidays

About the Company

Coastal is at the forefront of modern banking, combining strong financial infrastructure with cutting‑edge Banking-as-a-Service (BaaS) and fintech enablement strategies.