Lead, Cyber Security Operations - UAE National

TAQA Group; Abu Dhabi; On-site; AED 350,000 - 650,000; Full time

Job summary

TAQA Group is seeking a Lead, Cyber Security Operations to oversee advanced threat detection, response, and security architecture maintenance across IT and OT. You will drive threat hunting, incident response, and continuous protection for TAQA's critical assets in the UAE region.

The role requires 8+ years in an SOC, strong SIEM capabilities, and collaboration with cross-functional teams to strengthen defenses and regulatory compliance. An emphasis on proactive protection and remediation is key.

Qualifications

• 8+ years in a cybersecurity operations center role.
• Proven experience with threat monitoring, incident response and threat hunting.
• Strong analytical and collaboration skills across teams.

Responsibilities

• Lead threat monitoring programs and develop SIEM use cases.
• Monitor and respond to cybersecurity threats across IT/OT domains.
• Analyze logs and network data to identify anomalies and trends.
• Assess network/system integrity and escalate incidents to IR teams.
• Collaborate with stakeholders to investigate incidents and recommend remediations.
• Conduct risk analysis, simulate attacks, and perform ethical hacking as needed.
• Document incident reports and maintain regulatory compliance.
• Coordinate with MSSP/MDR providers and validate incidents.
• Support for forensic investigations and internal ethics investigations.

Skills

Threat hunting

Incident response

Security operations leadership

Analytical thinking

Education

Master's Degree in Engineering/ CS/ IT

Tools

Splunk Power User Certification

Job description

The Lead, Cyber Security Operations is responsible for advanced threat detection and response within TAQA Group's cybersecurity operations, including IWPP and other non-operated assets as defined by the UAE regulatory authority. This role involves analysing security events, identifying vulnerabilities, and implementing countermeasures to protect TAQA's digital assets and critical infrastructure. The Lead, Cyber Security Operations, in collaboration with security teams across TAQA, enhances the overall security posture and plays a key role in threat hunting, incident response, and maintenance of security architecture. The position also addresses intrusion alerts and malicious activities, implementing critical remediation measures to strengthen TAQA's security and ensure continuous protection across both IT and OT domains.

General Responsibilities:

• Policy, Procedures, Process, and Systems
• Ensure the compliance of the organization's policy, systems, processes, procedures, and controls in line with Group delegation of authority policy so that all relevant procedural/ legislative requirements are fulfilled while consistently delivering quality and cost-effective service.
• Reporting
• Ensure that all reports are completed in a timely manner and comply with HQ and business policies and standards.
• Provide support in the preparation of periodical management reports and progress reports to keep the business senior management informed about the progress of various initiatives and to facilitate decision-making.
• Comply with organization requirements in a timely manner.

Job Specific Responsibilities:

• Support the implementation of comprehensive threat monitoring programs, processes, procedures, and tools for collecting, analysing, and disseminating alerts, as well as developing security information and event management (SIEM) use cases.
• Monitor and respond to emerging cybersecurity threats affecting SOC environments, applications, and systems, including malware, phishing attacks, insider threats, and advanced persistent threats (APTs).
• Utilize SOC tools and techniques to actively search for indicators of compromise (IOCs), suspicious activities, and emerging threats within the TAQA environment, ensuring a proactive security posture.
• Analyse security event logs, network traffic, and other relevant data sources to identify patterns, trends, and anomalies indicative of potential threats or malicious activities, providing actionable insights for future prevention strategies.
• Assess and test network and system integrity to detect unauthorized behaviours, escalating findings to the Security Incident Response team for prompt resolution.
• Collaborate with internal and external stakeholders during investigations to determine whether a security incident has occurred, identify root causes, and provide recommendations for remediation.
• Perform risk analysis, attack simulations, and both automated and manual ethical hacking at the application level, developing proof-of-concept exploits as needed.
• Document and publish incident response reports for all incidents handled and closed, ensuring compliance with regulatory requirements.
• Manage the lifecycle of security incidents, including case tracking, documentation, and maintaining detailed records of investigations.
• Collaborate effectively with cross-functional teams, including security operations, incident response, network engineering, and IT support, to share insights, coordinate response efforts, and implement industry-leading security best practices.
• Stay updated about the latest cybersecurity threats, attack vectors, and industry trends through continuous research and threat intelligence feeds.
• Validate incidents reported by Managed Security Service Providers (MSSP) and Managed Detection and Response (MDR) service providers, providing feedback as necessary.
• Provide feedback on security incidents and response efforts to improve processes and tools used in the security operations center.
• Perform confidential forensic investigations and employee investigations as directed by the Ethics and Compliance team, ensuring thoroughness and adherence to organizational standards.
• Maintain a strong understanding of advanced threats and continuous vulnerability assessments used in cybersecurity operations.

These responsibilities are representative, and the role holder is also responsible for any other job assigned by the superior authorities from time to time.

• Technology, or equivalent
• 8+ years of experience in a cybersecurity operations center role
• Splunk Power User Certification

Preferred Requirements

• Master's Degree in Engineering/ Computer Science/ Information Technology/ or a certificate diploma or equivalent
• 10+ years of experience in a cybersecurity operations center role
• Certifications in CEH/ CISSP/ CSAP/ SAN/ GIAC/CySA and security tools are preferred