Identity Operational Engineer - Level 2

The Emirates Group; Dubai; On-site; AED 320,000 - 520,000; Full time

Job summary

The Emirates Group is seeking an Identity Operational Engineer - Level 2 to join our Cybersecurity team in Dubai. You will perform advanced monitoring, analysis and investigations to identify and resolve complex security incidents, validating AI-assisted findings and coordinating with escalation specialists for timely resolution.

Responsibilities include guiding Level 1 engineers, ensuring SLA-based resolutions, maintaining documentation, and developing automation playbooks to improve identity

Qualifications

• Degree or Honours in Information Technology and 3+ years of identity lifecycle management experience.
• GIAC Certified Incident Handler (GCIH) or equivalent certification.

Responsibilities

• Guide Level 1 engineers and the decision support system to ensure correct diagnosis.
• Ensure timely resolution of escalated incidents, service requests and control issues.
• Maintain auditable docs, logs and handovers for complex issues.
• Monitor threat and control information; assess impact and initiate action.
• Analyze identity-related threats and recommend preventative actions.
• Review triage and control activities for accurate closure or escalation.
• Create and maintain automation playbooks and knowledge-base content.

Skills

IAM mgmt

Zero-trust

Automation/AI tools

Incident response

Documentation

Education

IT degree

GCIH certification

Tools

IAM platforms

Cloud security

Automation tooling

Job description

At Emirates, we believe in connecting the world, to and through, our global hub in Dubai; and in constantly innovating to ensure our customers 'Fly Better'.

Join our Cybersecurity team, where we strive to maintain a world-class cybersecurity organisation built on the key principles of People, Process, and Technology, underpinned by executive endorsement of a multi-year strategy for continuous improvement and development. The team protects our digital assets by monitoring threats, responding to incidents,

managing vulnerabilities, and ensuring compliance with security policies and regulations.

The Identity Operational Engineer - L evel 2 will perform advanced cybersecurity monitoring, analysis, and investigations to identify and resolve complex security incidents, threats and control issues. Provide technical guidance to Level 1 engineers, validate AI- and automation-supported findings and response actions, and coordinate with escalation specialists to ensure effective, timely and well-controlled incident resolution.

In this role, you will:

• Guide Level 1 engineers and the decision support system to ensure correct diagnosis and effective use of approved Al and automation.
• Ensure timely resolution and fulfilment of escalated incidents, service requests and control issues within applicable SLAs.
• Maintain clear, accurate and auditable documentation, operational logs and effective handovers for complex incidents, service requests and control decisions.
• Monitor threat, vulnerability, service-health and control-performance information using approved analytical and automated capabilities; assess business and operational impact
• and initiate proportionate action.
• Perform detailed analysis of cyber threats, incidents, control failures and identity-related risks; validate Al- or automation-assisted findings and recommend preventative or
• corrective actions.
• Review operational triage and control-handling activities performed by Level 1 engineers or approved automation, ensuring accurate closure or escalation.
• Create and maintain operational procedures, automation playbooks, knowledge-base content and approved automation workflows, incorporating lessons from incidents and
• service issues.

Desired Candidate Profile

To be considered for this role, you must meet the below requirements:

• Degree or Honours (12+3 or equivalent) in Information Technology and 3+ years of experience in identity lifecycle management, authentication, authorisation and access-control principles.
• GIAC Certified Incident Handler (GCIH) or equivalent certification.

Knowledge/Skills:

• Knowledge of administering, configuring and monitoring enterprise identity and access-management platforms and operational workflows.
• Knowledge of infrastructure, cloud, endpoint, server, operating-system and network controls that support secure identity and authentication services.
• Knowledge of directory, database, protocol and web-service concepts supporting identity records, integrations and access controls.
• Practical knowledge of zero-trust, defence-in-depth and operational-resilience principles, including identity queries, basic scripting and approved automation or AI decision-support systems.
• Analyse identity, access and authentication evidence to identify issues and determine appropriate actions.
• Triage and prioritise identity and access requests or issues according to risk, urgency and operational impact.
• Make timely decisions within delegated authority and elevate identity matters to the appropriate access or resolver team.
• Use approved automation and AI tools effectively, validating recommendations and outcomes before progressing identity or access changes.
• Communicate identity and access matters clearly through accurate written and verbal reporting for technical and non-technical stakeholders.

Leadership Role: No.