Senior Security Engineer – EDR & NDR

Salt; Dubai; Hybrid; AED 300,000 - 520,000; Full time

Job summary

Salt is seeking a Senior Security Engineer in Dubai to design, implement, and optimize our enterprise security stack, focusing on EDR and NDR, while supporting security operations and incident response.

You will integrate EDR/NDR with SIEM/SOAR, perform threat hunting, and develop automation using PowerShell and Python. Collaboration with SOC and Threat Intelligence will be routine.

Qualifications

• 5-7 years of cybersecurity engineering or security operations experience.
• 4+ years hands-on administering enterprise EDR platforms.
• 3+ years administering NDR platforms.
• Experience with one or more EDR solutions as listed.

Responsibilities

• Deploy, configure, and optimize enterprise EDR platforms.
• Manage NDR platforms including sensor config and detection tuning.
• Integrate EDR/NDR with SIEM, SOAR, identity, and threat intel.
• Troubleshoot issues, perform upgrades, and runbooks.
• Support incident response, containment, malware remediation, and forensics.
• Threat hunting and refine MITRE ATT&CK aligned detections.
• Develop automation via APIs and scripting.
• Document architecture, SOPs, and operational runbooks.
• Collaborate with SOC, IR, Threat Intelligence, and Security Engineering teams.

Skills

Threat hunting

Incident response

Security operations

Endpoint security

Network security

Tools

Microsoft Defender for Endpoint

CrowdStrike Falcon

VMware Carbon Black

Trend Micro Vision One

Vectra AI

ExtraHop Reveal(x)

Splunk Enterprise Security

Microsoft Sentinel

PowerShell

Python

REST APIs

Job description

We're looking for a Senior Security Engineer specializing in Endpoint Detection & Response (EDR) and Network Detection & Response (NDR) to design, implement, optimize, and support enterprise security platforms across customer environments.

This role is ideal for a hands‑on security engineer with strong experience in endpoint and network detection technologies, platform integrations, threat hunting, and security operations.

Key Responsibilities

• Deploy, configure, administer, and optimize enterprise EDR platforms.
• Manage NDR platforms, including sensor configuration, network visibility, behavioral analytics, and detection tuning.
• Integrate EDR/NDR solutions with SIEM, SOAR, identity, and threat intelligence platforms.
• Troubleshoot platform issues, perform upgrades, health checks, and lifecycle management.
• Support incident response activities, endpoint containment, malware remediation, and forensic investigations.
• Conduct threat hunting and improve detection use cases aligned with the MITRE ATT&CK framework.
• Develop automation workflows using APIs and scripting.
• Maintain technical documentation, SOPs, architecture diagrams, and operational runbooks.
• Collaborate with SOC, Incident Response, Threat Intelligence, and Security Engineering teams.

Requirements

• 5-7 years of experience in cybersecurity engineering or security operations.
• At least 4 years of hands‑on experience administering enterprise EDR platforms.
• At least 3 years of experience administering NDR platforms.

Experience with one or more EDR solutions:

• Microsoft Defender for Endpoint
• CrowdStrike Falcon
• VMware Carbon Black
• Trend Micro Vision One / Apex One

Experience with NDR solutions such as:

• Vectra AI
• ExtraHop Reveal(x)

• Working knowledge of SIEM platforms, preferably Splunk Enterprise Security and/or Microsoft Sentinel.
• Familiarity with threat hunting, incident response, detection engineering, and MITRE ATT&CK.
• Understanding of Windows/Linux security, Active Directory, Microsoft Entra ID, TCP/IP, DNS, VPNs, and firewalls.
• Scripting experience with PowerShell and/or Python, and familiarity with REST APIs.
• Experience in a SOC or Managed Security Services (MSS) environment is highly desirable.

Preferred Certifications

• CrowdStrike Falcon Administrator / Responder
• Microsoft SC-200 or AZ-500
• VMware Carbon Black or Trend Micro Vision One certifications
• Vectra AI or ExtraHop certifications
• Splunk or Microsoft Sentinel certifications
• CISSP, GCIH, GCED, CySA+, Security+, or equivalent