Internal Security & Security Operations Engineer

UltaHost; Dubai; On-site; AED 350,000 - 520,000; Full time

Job summary

UltaHost in Dubai seeks a Senior Internal Security & Security Operations Engineer to own internal security, IAM, and SOC operations. You will secure employee identities, privileged access, endpoints, and cloud/SaaS environments while coordinating across HR, IT, and product teams.

This hands-on role requires experience with RBAC, MFA, SSO, PAM, SIEM, EDR, and incident response. You will monitor events, investigate incidents, collect evidence, and drive remediation to reduce risk, aiming for

Qualifications

• Senior, hands‑on role focusing on IAM, internal security, and SOC operations.
• Experience implementing and auditing access controls and lifecycle management.
• Strong knowledge of RBAC, MFA, SSO, PAM, and credential management.
• Proven ability to monitor security events and coordinate incident response.

Responsibilities

• Design and maintain RBAC across departments and critical systems.
• Manage MFA, SSO, PAM, password vaults, and secret management.
• Lead security monitoring, alert triage, and incident response.
• Investigate suspicious activity, contain threats, and drive remediation.
• Collaborate with HR/IT and product teams to improve access governance.

Skills

RBAC

MFA

SSO

PAM

Identity providers

Password management

Access auditing

Incident response

Security monitoring

Cloud/SaaS security

End-user security awareness

Education

Bachelor's degree in Computer Science or Information Security

Security+ or CISSP certification

GCIH or SC-200 certification

Tools

SIEM

EDR

IDS/IPS

Centralized logging

Cloud/SaaS security tooling

Job description

Internal Security & Security Operations Engineer

Dubai

Full-Time

UltaHost is looking for a Senior Internal Security & Security Operations Engineer to take ownership of internal security and help strengthen the protection of our workforce, identities, systems, and day-to-day operations.

This is a senior, hands-on technical role with responsibility across Identity & Access Management (IAM), internal security, security monitoring, SOC operations, and incident response. The position requires someone who can combine strong technical security expertise with a structured and operational approach to access control, monitoring, investigation, and risk reduction.

You will be responsible for securing employee and contractor identities, privileged access, credentials, internal systems, endpoints, VPN and remote access, while ensuring that appropriate security controls are implemented and maintained throughout the account and access lifecycle.

A key part of the role will also involve actively monitoring security events and investigating suspicious activity across authentication systems, endpoints, internal applications, and cloud/SaaS environments. You will take an active role in identifying potential threats, investigating security incidents, collecting evidence, containing risks, coordinating remediation, and ensuring corrective actions are followed through to closure.

You will work closely with HR, IT, system owners, and other technical teams to improve access governance, strengthen internal security controls, enhance detection and response capabilities, and reduce security risks across UltaHost’s internal environment.

We are looking for someone who is comfortable taking end-to-end ownership — from implementing preventive controls and improving security monitoring to investigating real incidents and driving security improvements across the organization.

What You’ll Own

Identity, Access & Credential Security

• Design and maintain RBAC across departments, roles, and critical systems.
• Manage MFA, SSO, PAM, password vaults, API keys, SSH keys, recovery codes, and secrets.
• Own security controls around onboarding, role changes, temporary access, contractor access, and offboarding.
• Identify and remove shared, dormant, unnecessary, and excessively privileged accounts.
• Conduct regular access reviews and maintain approval and audit evidence.

Security Monitoring & Incident Response

• Monitor and investigate alerts from SIEM, EDR, IDS/IPS, authentication systems, cloud/SaaS platforms, internal applications, and endpoints.
• Investigate suspicious logins, compromised accounts, credential leaks, malware, privilege abuse, insider risk, and unauthorized access.
• Collect evidence, contain threats, coordinate recovery, and drive corrective actions through closure.
• Maintain detection rules, alert quality, incident records, escalation paths, and response playbooks.
• Lead internal security incidents and support infrastructure/product incidents involving identities or credentials.

Internal Systems & Workforce Security

• Define security requirements for laptops, VPN and remote access, email, code repositories, support platforms, finance tools, and administrative systems.
• Work closely with HR and IT on joiner/mover/leaver processes and internal security investigations.
• Support security awareness, phishing prevention, and secure handling of sensitive information and credentials.

What We’re Looking For

• 5+ years of hands‑on experience in internal security, IAM, SOC/security operations, incident response, IT security, or a closely related role.
• Practical experience with RBAC, MFA, SSO, PAM, identity providers, password management, account lifecycle management, and access auditing.
• Hands‑on experience with SIEM, EDR, IDS/IPS, centralized logging, authentication logs, alert triage, and case management.
• Proven ability to investigate compromised accounts, malware, credential leaks, suspicious authentication activity, insider risk, and unauthorized access.
• Strong understanding of Linux access, SSH, VPN, endpoints, cloud/SaaS administration, email security, and remote‑workforce security.
• Strong organizational skills and the ability to enforce security controls while collaborating with HR, IT, managers, and system owners.

Preferred Background

Experience in web hosting, cloud infrastructure, data centers, SaaS, fintech, MSSP, or another distributed technology environment is highly valuable. Preferred certifications include Security+, CySA+, GCIH, SC-200, IAM/PAM vendor certifications, CISSP, or equivalent practical expertise. Certifications are a plus — hands‑on experience matters more.

What Success Looks Like

You will help us improve:

• MFA and privileged‑access coverage
• Joiner/mover/leaver security and access‑removal speed
• Control of shared, dormant, and excessive access
• Alert response and incident‑resolution times
• Access-review coverage and security evidence
• Internal security standards, procedures, and playbooks

Important

We are not looking for a policy/compliance-only profile. The successful candidate must have real hands‑on experience administering access controls, operating security tooling, investigating logs, and responding to security incidents.

You will work closely with our second cybersecurity specialist, the Product & Infrastructure Security Engineer, as well as DevOps, Network, Product, Engineering, Support, Abuse, HR, Finance, Legal, and executive management.