Security Operations Center Analyst L2

SecurityHQ Ltd.; Dubai; On-site; AED 180,000 - 300,000; Full time

Job summary

SecurityHQ Ltd. is seeking a SOC Analyst Level 2 to join our 24/7 Security Operations Centre in Dubai.

You will lead investigations, coordinate containment and remediation, and mentor SOC Level 1 Analysts across SIEM, EDR, network and endpoint security. Working with global teams, you will develop detection rules, playbooks, and proactive threat-hunting initiatives while maintaining strong incident reporting and customer communications.

Qualifications

• Experience in a SOC, MSSP, or cybersecurity operations environment.
• Strong experience investigating and responding to security incidents across SIEM and EDR platforms.
• Solid understanding of MITRE ATT&CK and Cyber Kill Chain frameworks.
• Experience analyzing malware, phishing, lateral movement, privilege escalation, and other advanced threats.
• Strong networking knowledge and traffic analysis skills.
• Ability to perform advanced log analysis and correlate events across multiple security tools.
• Certifications such as GCIH, GCIA, CEH, SC-200, or SIEM-specific certs are a plus.

Responsibilities

• Perform in-depth investigation of security incidents escalated from SOC Level 1 Analysts.
• Analyze complex events across SIEM, EDR, network, endpoint, and cloud security technologies.
• Identify attack vectors, determine root cause, and assess scope and impact of incidents.
• Investigate malware, phishing, suspicious activity, and advanced threat campaigns.
• Lead containment, mitigation, and remediation activities with internal and customer teams.
• Develop and enhance detection rules, use cases, SOC playbooks, and monitoring capabilities.
• Participate in proactive threat hunting and continuous security improvement initiatives.
• Provide technical guidance and mentoring to SOC Level 1 Analysts.
• Produce detailed incident reports, root cause analyses, and customer-facing communications.
• Support compliance, audit, and post-incident review activities.
• Assist with administration and optimization of SIEM and EDR platforms.

Skills

SOC Analyst

Incident response

Threat hunting

Mentoring

Log analysis

Communication

Decision making

Tools

Microsoft Sentinel

QRadar

Splunk

Azure

AWS

GCP

Job description

About the Role

As a SOC Analyst Level 2, you will play a critical role in our 24/7 Security Operations Centre, leading the investigation and response to complex security incidents across a diverse customer environment.

Working closely with SOC Level 1 Analysts, Incident Responders, and Security Engineers, you will perform advanced analysis across SIEM, EDR, network, and endpoint technologies to identify threats, determine root cause, and coordinate effective containment and remediation activities.

This role is ideal for an experienced SOC professional who enjoys solving complex security challenges, mentoring junior analysts, and contributing to the continuous improvement of detection capabilities within a fast-paced MSSP environment.

You will work on a rotating shift schedule (7 AM to 3 PM, 3 PM to 11 PM, 11 PM to 7 AM), including weekends and holidays, with two days off per week.

You will be based onsite in Dubai and assigned to one of three customer locations. All sites are located within approximately 20km of SecurityHQ's Dubai office, providing variety in your day-to-day environment while remaining within a local area.

About SecurityHQ

SecurityHQ is a global cybersecurity company. Our specialist teams design, engineer and manage solutions that do three things: Promote clarity and trust in a complex world. Build momentum around improving security posture. And increase the value of cybersecurity investment within organizations.

Free from limitations, and inclusive of all requirements, we focus on defending today, while mitigating the risks of tomorrow. And into the future. Our solutions are tailored to our customers and their unique context. Around the clock, 365 days per year, our customers are never alone.

SecurityHQ – We’re focused on engineering cybersecurity, by design.

Responsibilities

• Perform in-depth investigation of security incidents escalated from SOC Level 1 Analysts.
• Analyze complex events across SIEM, EDR, network, endpoint, and cloud security technologies.
• Identify attack vectors, determine root cause, and assess the scope and impact of security incidents.
• Investigate malware, phishing, suspicious activity, and advanced threat campaigns.
• Lead containment, mitigation, and remediation activities in collaboration with internal and customer teams.
• Develop and enhance detection rules, use cases, SOC playbooks, and monitoring capabilities.
• Participate in proactive threat hunting and continuous security improvement initiatives.
• Provide technical guidance and mentoring to SOC Level 1 Analysts.
• Produce detailed incident reports, root cause analyses, and customer-facing communications.
• Support compliance, audit, and post-incident review activities.
• Assist with the administration and optimization of SIEM and EDR platforms.

What We Are Looking For

• Experience within a SOC, MSSP, or cybersecurity operations environment.
• Strong experience investigating and responding to security incidents across SIEM and EDR platforms.
• Solid understanding of attack frameworks such as MITRE ATT&CK and Cyber Kill Chain.
• Experience analyzing malware, phishing attacks, lateral movement, privilege escalation, and other advanced threats.
• Strong knowledge of networking concepts, protocols, and traffic analysis.
• Ability to perform advanced log analysis and correlate events across multiple security tools.
• Experience working with Microsoft Sentinel, QRadar, Splunk, or similar SIEM technologies.
• Familiarity with Azure, AWS, or GCP security monitoring is advantageous.
• Ability to make sound decisions under pressure and manage multiple security incidents simultaneously.
• Strong communication skills and the ability to work collaboratively within a global team environment.
• Relevant cybersecurity certifications such as GCIH, GCIA, CEH, SC-200, or SIEM-specific certifications are beneficial.