Engineer/Incident Management

e& UAE; Abu Dhabi; On-site; AED 240,000 - 360,000; Full time

Job summary

e& UAE is seeking a technical SOC Specialist with 3-5 years of experience to drive incident response and threat detection in a 24/7 Security Operations Center. You will handle full incident lifecycle—from triage and traffic analysis to host recovery and remediation—and design automated SOAR playbooks to strengthen defenses.

The role requires deep Windows and Linux expertise, strong log analysis skills, and experience with SIEMs (ArcSight, Microsoft Sentinel) and threat intelligence.

Qualifications

• BSc in Computer Science, Electrical/Computer/Software Engineering.
• Mandatory: SIEM Based Trainings, FortiSOAR Training
• Preferred: GCIH Certification, Incident Handler Training, Linux+, Security+, CCNA, CCNA Security, FortiSOAR Certification
• Experience in Security Operations Center environments and handling cybersecurity incidents.
• Proficient with SIEM technologies (ArcSight, Microsoft Sentinel) and Threat Intelligence platforms.

Responsibilities

• Real-Time 24/7 monitoring and incident triage.
• Lead incident response, containment, and recovery activities.
• Perform log correlation and analysis to detect suspicious activity.
• Design and optimize SOAR playbooks and automation modules.
• Document findings and actions in the ticketing system with actionable remediation insights.

Skills

Incident response

Threat detection

Log analysis

KQL

SOAR automation

MITRE ATT&CK

Windows & Linux

Threat intelligence

Education

BSc in Computer Science / Electrical Engineering / Software Engineering

Tools

ArcSight

Microsoft Sentinel

FortiSOAR

Job description

Job Description

We are seeking a technical SOC Specialist with 3-5 years' experience to drive high-level incident response and threat detection within our 24/7 Security Operations Center. This role is responsible for the full incident lifecycle—from initial triage and traffic analysis to host recovery and remediation. The ideal candidate combines deep knowledge of Windows/Linux environments with the ability to design automated SOAR playbooks that enhance our defensive posture.

Responsibilities

Incident Management & Response

• Real-Time Monitoring: Provide continuous 24/7 oversight of security events and alerts.
• Triage & Prioritization: Manage and categorize alerts from SIEM, Anti-DDoS, and other security solutions based on urgency and risk.
• Incident Response Operations: Lead technical response activities, including host triage, containment, and recovery.
• Remediation & Analysis: Conduct remote system analysis and implement remediation efforts using strong correlation skills.
• Lifecycle Management: Maintain the full incident response lifecycle and ensure all actions adhere to established SLAs (Service Level Agreements).

Security Automation & Intelligence

• SOAR Optimization: Identify opportunities for automation in manual workflows and design automated playbooks and modules in the SOAR platform.
• Threat Analysis: Apply a detailed understanding of the MITRE ATT&CK Framework to identify and map attacker techniques.
• Threat Intelligence: Analyze global threat landscapes, including cyber threat intelligence, new vulnerabilities, and exploit code to stay ahead of adversaries.
• Vulnerability Assessment: Study vulnerabilities and provide technical recommendations for corrective actions and reporting.

Technical Expertise & Maintenance

• Platform Mastery: Maintain deep knowledge of Security Technologies, Operating Systems (Windows & Linux), and deep-packet analysis tools like Wireshark.
• Log Analysis: Utilize extensive experience in log correlation and analysis to detect and investigate suspicious patterns.
• Incident Documentation: Ensure all findings, communication, and mitigation steps are thoroughly recorded in the ticketing system.

Qualifications

BSc in Computer Science, Electrical/Computer/Software Engineering.

Mandatory: SIEM Based Trainings, FortiSOAR Training

Preferred: GCIH Certified, Incident Handler Training, Linux+, Security+, CCNA, CCNA Security, FortiSOAR Certification

• Thorough experience in Security Operations Center environment.
• Experience in handling Cyber Security Incidents.
• Experience with SIEM technologies such as ArcSight, Microsoft Sentinel, etc. and Threat Intelligence Platform.
• Expertise in gauging automation potential in SOC manual processes/workflows and designing their transformation into automated SOC/IR playbooks and Modules within FortiSOAR.
• Understanding the global threat landscape by analyzing cyber threat intelligence.
• Extensive experience in Incident Response activities and skilled in Log Analysis.
• Ability to write and execute complex queries using KQL (Kusto Query Language)
• Experience with Anti-DDoS solutions, preferably at a Service Provider level.
• Monitoring experience of security tools like SIEM, Anti-DDoS, IPS, EDR, firewalls, and MFA systems.
• Flexible to work in shifts and willing to assist team overtime if needed.
• Sound understanding of common network services (Web, Mail, FTP, DNS etc), network vulnerabilities and network attack patterns.