Lead Security Analyst - 24/7 SOC, Abu Dhabi

Core42; Abu Dhabi; On-site; AED 360,000 - 480,000; Full time

Benefits offered by this job

Competitive salary

Yearly bonus

Discount cards (Esaad/Fazaa)

Premium family insurance

Learning & development

Job summary

Core42, a leader in AI-powered cloud infrastructure, seeks a Security Analyst to anchor 24x7 SOC operations in Abu Dhabi. You will own end-to-end incident response from alert to recovery, tune detections, and mentor junior analysts in a private-cloud OpenStack/OpenShift environment.

Role requires hands-on Splunk and Cribl experience, strong networking knowledge, and expertise across Windows/Linux. Rotational shifts apply, with cross-team collaboration and playbook development.

Qualifications

• Bachelor's degree in Computer Science, Information Security or related field, or equivalent experience.
• 5–8 years in security operations, with at least 2 years in a senior role.
• Hands-on Splunk experience: advanced SPL, dashboards, correlation and tuning.
• Experience with Cribl for data routing and pipeline management.
• Experience with EDR/NDR tools for endpoint and network threat detection.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain and Diamond Model.
• Strong networking, Windows and Linux proficiency.

Responsibilities

• Monitor alerts in Splunk to detect threats across private-cloud and enterprise services.
• Triages and investigates security events, acting as senior technical decision point.
• Lead escalation and guidance for front-line analysts during incidents.
• Own end-to-end incident response: identification, containment, eradication, recovery and RCA.
• Develop and maintain incident playbooks and SOPs; improve detections post-incident.
• Tune Splunk searches, dashboards and reports to improve coverage and reduce false positives.
• Validate log quality and onboard new log sources; manage Cribl pipelines.
• Map detections to MITRE ATT&CK and report gaps; conduct threat hunts.
• Coordinate with cross-functional teams for containment and remediation actions.
• Support audit/compliance with evidence of incident-management activities.

Skills

Splunk Enterprise/Cloud

SPL

Cribl Stream/Edge

Elastic Security (EDR)

Corelight (NDR)

Incident response

Playbooks & SOPs

Python/Bash/PowerShell

MITRE ATT&CK mapping

OpenStack/OpenShift

Networking (TCP/IP, DNS, HTTP/S)

Windows/Linux

Jira/ServiceNow

Education

Bachelor's degree in CS/InfoSec or related

Tools

Splunk

Cribl

OpenStack

OpenShift

Job description

Core42, a leader in AI-powered cloud infrastructure, seeks a Security Analyst to anchor 24x7 SOC operations in Abu Dhabi. You will own end-to-end incident response from alert to recovery, tune detections, and mentor junior analysts in a private-cloud OpenStack/OpenShift environment.

Role requires hands-on Splunk and Cribl experience, strong networking knowledge, and expertise across Windows/Linux. Rotational shifts apply, with cross-team collaboration and playbook development.