Detection Engineer (SIEM / XDR) | Senior Associate 2

PricewaterhouseCoopers Schweiz; United Arab Emirates; On-site; AED 150,000 - 230,000; Full time

Job summary

PricewaterhouseCoopers Schweiz is seeking a Security Operations professional to monitor, investigate, and analyze security events using SIEM solutions in the UAE.

You will correlate logs, perform event analysis using MITRE ATT&CK and NIST, and develop automations to optimize monitoring and investigations. You will prepare technical and executive reports and stay current with cyber threats and technologies.

Qualifications

• Completed undergraduate degree in Information Security, Computer Science, Software Engineering, or related field.
• Experience with SIEM and log correlation.
• Experience in SOC environments.
• Ability to communicate technical findings to non-technical audiences.

Responsibilities

• Monitor, investigate and analyze security events using SIEM solutions.
• Correlate logs to identify threats and incidents.
• Perform event analysis using MITRE ATT&CK and NIST frameworks.
• Develop automations and scripts to optimize monitoring and investigation processes.
• Prepare technical and executive reports presenting findings and recommendations.
• Identify patterns, anomalies and trends in large data sets.
• Contribute to evolving detection and response processes.
• Stay updated on threat landscape and security technologies.

Skills

SIEM experience

Log analysis

Scripting (Python)

Shell scripting

MITRE ATT&CK

NIST frameworks

English proficiency

Analytical skills

Communication

Teamwork

Education

Bachelor's degree in Information Security

Tools

XSIAM

Google SecOps

Microsoft Sentinel

Sigma

Job description

Your role in this journey

• Monitor investigate and analyze security events using SIEM solutions
• Correlate system, network and security tool logs to identify threats, suspicious behavior and potential incidents
• Perform event analysis based on TTPs, Tactics, Techniques and Procedures and market frameworks such as MITRE ATT amp CK and NIST
• Develop and improve automations and scripts to optimize monitoring and investigation processes
• Support the preparation of technical and executive reports presenting findings and recommendations to different audiences
• Actively identify patterns, anomalies and trends through the analysis of large volumes of data
• Contribute to the continuous evolution of security incident detection and response processes
• Stay updated on the cyber threat landscape, new attack techniques and security technologies

Qualifications

• Experience with SIEM tools, preferably XSIAM, Google SecOps, or Microsoft Sentinel.
• Knowledge of query and investigation languages such as SPL, XQL, KQL, LEQL, and Sigma.
• Experience in correlating security events and analyzing system and network logs.
• Knowledge of information security frameworks and best practices, such as MITRE ATT amp CK and NIST.
• Knowledge of script development, preferably using Python and Shell Script.
• Analytical skills to work with large volumes of data and identify patterns or anomalies.
• Ability to translate technical concepts for non-technical audiences.
• Experience in preparing technical reports and executive presentations.
• Excellent communication and teamwork skills.
• Proactive profile with a continuous interest in learning and professional development in the field of Cybersecurity.

Education

• Completed undergraduate degree in Information Security, Computer Science, Software Engineering, or related fields.

It can be a plus if you have:

• English proficiency for reading technical documentation and interacting with industry reference materials.
• Certifications in Information Security, SIEM, or Cloud Security.
• Experience in Security Operations Center (SOC) environments.
• Knowledge of security process automation and incident response.
• Experience with multiple security monitoring platforms and technologies.