Senior Incident Responder & Threat Hunter

Secuwall; Dubai; On-site; AED 280,000 - 560,000; Full time

Job summary

Secuwall is seeking a Senior Security Engineer to lead incident response, threat hunting, and automation across hybrid environments. You will build DaC detections, implement AI-assisted security workflows, and drive proactive defense with modern data stacks and SIEM platforms.

The role emphasizes memory forensics, rapid containment, and scalable security automation in AWS/Azure/GCP plus on-premises infrastructure.

Qualifications

• 4+ years in Incident Response, Threat Hunting, or Security Engineering in complex enterprise or MSSP settings.
• Deep knowledge of SIEM/SOC platforms such as Splunk, QRadar, ELK, Google SecOps, or Microsoft Sentinel.
• Hands-on experience with OpenSearch, ClickHouse, Apache Flink, Vector, and DFIR-IRIS.
• Proven ability to perform incident containment using major EDR/XDR, WAFs, and Next-Gen Firewalls.
• Strong programming/scripting skills (Python mandatory; Go, Rust, or Bash a plus).
• Hybrid cloud and on-premise networking expertise (AWS/Azure/GCP, TCP/IP, AD, virtualization).

Responsibilities

• Lead IR operations across multi-cloud, on-premise, and physical servers with forensics.
• Contain breaches via EDR/XDR, deploy WAF rules, and apply zero-trust blocks.
• Architect automated forensic data collection pipelines and manage incident lifecycles.
• Develop DaC detections, test with Git and CI/CD, and enhance threat hunting.
• Collaborate with AI engineering to automate security workflows.

Skills

Incident Response

Threat Hunting

Security Engineering

SIEM & SOC Platforms

OpenSearch

ClickHouse

Apache Flink

Vector

DFIR-IRIS

EDR/XDR

WAFs (Cloudflare, F5)

Next-Gen Firewalls

Python

Go/Rust/Bash

Cloud Architecture (AWS/Azure/GCP)

Tools

Splunk

IBM QRadar

ELK Stack

Google SecOps

Microsoft Sentinel

OpenSearch

ClickHouse

Apache Flink

Vector

DFIR-IRIS

Job description

Secuwall is seeking a Senior Security Engineer to lead incident response, threat hunting, and automation across hybrid environments. You will build DaC detections, implement AI-assisted security workflows, and drive proactive defense with modern data stacks and SIEM platforms.

The role emphasizes memory forensics, rapid containment, and scalable security automation in AWS/Azure/GCP plus on-premises infrastructure.