L2 Splunk SOC Engineer: Threat Hunting & Incident Response

VaporVM; Dubai; On-site; AED 180,000 - 300,000; Full time

Job summary

VaporVM Ltd. is seeking a skilled Security Operations Center (SOC) Analyst to monitor and investigate security incidents using Splunk, analyze events across sources, and escalate as needed. You will develop Splunk searches, tune detection use cases, reduce false positives, and prepare incident reports.

This role requires collaboration with L1/L3 teams and participation in 24/7 SOC shifts. Experience in MITRE ATT&CK techniques, threat hunting, and maintaining dashboards is a plus.

Responsibilities

• Perform advanced monitoring and investigation of security incidents using Splunk
• Analyze and correlate events across multiple security and IT data sources
• Investigate escalated incidents from L1 analysts
• Conduct detailed root-cause analysis of security incidents
• Validate and investigate suspicious activities and potential threats
• Develop and optimize Splunk searches and correlation rules
• Review and tune existing Splunk detection use cases
• Reduce false positives and improve detection accuracy
• Develop and maintain dashboards and operational reports
• Analyze Malware activity Phishing attempts Account compromise Privilege escalation Lateral movement Data exfiltration Suspicious network activity Endpoint threats
• Utilize MITRE ATT& CK techniques during investigations
• Perform threat hunting activities using Splunk
• Support incident containment and remediation activities
• Coordinate with L1 and L3 teams during major incidents
• Prepare detailed incident investigation reports
• Participate in incident response and crisis management activities
• Support development and enhancement of SOC use cases
• Monitor and maintain SOC KPIs and SLAs
• Provide technical guidance to L1 engineers
• Participate in 24 7 SOC shift operations when required

Job description

VaporVM Ltd. is seeking a skilled Security Operations Center (SOC) Analyst to monitor and investigate security incidents using Splunk, analyze events across sources, and escalate as needed. You will develop Splunk searches, tune detection use cases, reduce false positives, and prepare incident reports.

This role requires collaboration with L1/L3 teams and participation in 24/7 SOC shifts. Experience in MITRE ATT&CK techniques, threat hunting, and maintaining dashboards is a plus.