Security Analyst (Security Monitoring & Incident Investigation)

Caliberly® - Recruitment Agency; Dubai; On-site; AED 300,000 - 480,000; Full time

Job summary

Caliberly® - Recruitment Agency in Dubai is seeking a Security Analyst responsible for investigating, analysing and responding to security incidents across the organisation's security environment. You will monitor, detect and respond to threats, leveraging SIEM and EDR tools to protect critical assets.

The ideal candidate holds a Bachelor's degree in a related field and 3–5 years in SOC operations, with hands-on experience in security monitoring, incident investigation and threat hunting.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, Cybersecurity or a related discipline.
• 3–5 years of experience in SOC operations or cybersecurity.
• Minimum 2 years of hands-on experience in security monitoring and incident investigation.
• Certifications such as SC-200, AZ-500, CrowdStrike or Security+ are desirable.

Responsibilities

• Monitor and investigate security alerts escalated from L1 SOC analysts.
• Perform in-depth analysis of security events to identify threats, suspicious activities and IOCs.
• Investigate complex security incidents and determine scope, impact and severity.
• Correlate security events across sources to identify attack patterns.
• Monitor and investigate incidents using Microsoft Sentinel.
• Develop, modify and optimise KQL queries for threat hunting and incident investigation.
• Analyse logs from endpoints, networks, cloud environments and Microsoft 365.
• Support the development and tuning of analytics rules and detection use cases.
• Monitor and investigate endpoint security alerts using CrowdStrike Falcon.
• Perform endpoint threat analysis, malware investigation and suspicious process analysis.
• Utilise Defender for Endpoint to investigate threats and containment.
• Coordinate endpoint isolation, remediation and recovery activities.
• Identify recurring endpoint threats and recommend preventive measures.
• Conduct proactive threat hunting to identify hidden threats.
• Analyse IOCs, TTPs and attack patterns using MITRE ATT&CK.
• Support incident containment, eradication and recovery.
• Prepare detailed incident reports and corrective actions.
• Prepare incident investigation reports and maintain case documentation.
• Escalate critical security incidents to L3 or stakeholders.
• Support L1 analysts through technical guidance and knowledge sharing.
• Contribute to SOC process improvement.

Skills

SOC operations

Security monitoring

Incident investigation

Threat hunting

MITRE ATT&CK

Endpoint security

KQL

SOC operations understanding

Education

Bachelor’s degree in Computer Science, Information Security, Cybersecurity or related field

Tools

Microsoft Sentinel

CrowdStrike Falcon

Microsoft Defender for Endpoint

Job description

We are currently looking for a Security Analyst will be responsible for investigating, analysing and responding to security incidents across the organisation's security environment

Location: Dubai, UAE

What we are looking:

• Bachelor's degree in Computer Science, Information Security, Cybersecurity or a related discipline.
• 3–5 years of experience in SOC operations or cybersecurity.
• Minimum 2 years of hands‑on experience in security monitoring and incident investigation.
• Relevant certifications such as SC-200, AZ-500, CrowdStrike certifications, Security+ or equivalent are desirable.

What you'll do:

Key Responsibilities

1. Security Monitoring & Incident Investigation

• Monitor and investigate security alerts escalated from L1 SOC analysts.
• Perform in-depth analysis of security events to identify potential threats, suspicious activities and indicators of compromise (IOCs).
• Investigate complex security incidents and determine their scope, impact and severity.
• Correlate security events across multiple sources to identify attack patterns.

2. SIEM – Microsoft Sentinel

• Monitor and investigate security incidents using Microsoft Sentinel.
• Develop, modify and optimise KQL queries for threat hunting and incident investigation.
• Analyse logs and security events from endpoints, networks, cloud environments and Microsoft 365.
• Support the development and tuning of analytics rules, workbooks and detection use cases.

3. Endpoint Security – CrowdStrike & Microsoft Defender

• Monitor and investigate endpoint security alerts using CrowdStrike Falcon.
• Perform endpoint threat analysis, malware investigation and suspicious process analysis.
• Utilise Microsoft Defender for Endpoint to investigate threats, assess endpoint exposure and support incident containment.
• Coordinate endpoint isolation, remediation and recovery activities.
• Identify recurring endpoint threats and recommend preventive security measures.

4. Threat Hunting & Incident Response

• Conduct proactive threat hunting to identify hidden or emerging threats.
• Analyse IOCs, TTPs and attack patterns using MITRE ATT&CK.
• Support incident containment, eradication and recovery.
• Prepare detailed incident reports and recommend corrective actions.

5. Reporting & Escalation

• Prepare incident investigation reports and maintain accurate case documentation.
• Escalate critical security incidents to L3 or relevant stakeholders.
• Support L1 analysts through technical guidance and knowledge sharing.
• Contribute to continuous improvement of SOC processes and detection capabilities.

Required Technical Skills

• Hands-on experience with Microsoft Sentinel (SIEM).
• Strong practical experience with CrowdStrike Falcon (EDR).
• Experience with Microsoft Defender for Endpoint and Microsoft security ecosystem.
• Proficiency in KQL for security investigation and threat hunting.
• Strong understanding of SIEM, EDR, XDR and SOC operations.
• Knowledge of incident response, malware analysis and endpoint investigation.
• Familiarity with MITRE ATT&CK framework and threat intelligence.
• Understanding of Windows operating systems, Active Directory and network security fundamentals.