Senior Security Engineer - EDR & NDR

Help AG; Dubai; Hybrid; AED 260,000 - 460,000; Full time

Benefits offered by this job

Health insurance

Flexible/Hybrid working environment

Job summary

Help AG is seeking a Senior Security Engineer focused on EDR and NDR to design, implement, and optimize enterprise security platforms. You will work with SOC, Incident Response, Threat Intelligence, and SIEM teams to deliver high-quality managed security services for customer environments in the UAE.

Responsibilities include platform administration, integration with SIEM/SOAR, and developing automation using APIs and scripting.

Qualifications

• 5–7 years of experience in cybersecurity engineering or security operations.
• 4+ years hands-on experience administering enterprise EDR platforms.
• 3+ years administering NDR platforms.

Responsibilities

• Design, implement, administer, optimize, and support EDR/NDR platforms across customer environments.
• Collaborate with SOC Analysts, Incident Response, Threat Intelligence, SIEM Engineering, Solution Architects, and customers.
• Design integrations between EDR/NDR and SIEM, SOAR, Threat Intelligence, AD/Microsoft Entra ID, and ITSM.

Skills

EDR platforms

NDR platforms

SOC collaboration

Threat detection

MITRE ATT&CK

PowerShell

Python scripting

Education

VMware Carbon Black Administrator

Trend Micro Vision One Professional

Microsoft Security Operations Analyst (SC-200)

Azure Security Engineer (AZ-500)

Splunk Core Certified/ES Admin/Microsoft Sentinel

CISSP/GCIH/GCED/CySA+/Security+

Tools

Microsoft Defender for Endpoint

CrowdStrike Falcon

VMware Carbon Black Cloud

Trend Micro Vision One/Apex One

Vectra AI

ExtraHop Reveal(x)

Splunk Enterprise Security

Microsoft Sentinel

Job description

Help AG is looking for a Senior Security Engineer – EDR & NDR who will be responsible for the design, implementation, administration, optimization, and support of Endpoint Detection & Response (EDR) and Network Detection & Response (NDR) platforms across customer environments. The role requires strong technical expertise in deploying, integrating, tuning, and maintaining enterprise security platforms while ensuring optimal performance, visibility, and security coverage.
The engineer will work closely with SOC Analysts, Incident Response, Threat Intelligence, SIEM Engineering, Solution Architects, and customers to deliver high-quality Managed Security Services and support strategic cybersecurity initiatives.

Responsibilities

• EDR Platform Administration
  • Deploy, configure, administer, and maintain enterprise EDR platforms including:
    
    • Microsoft Defender for Endpoint
    • CrowdStrike Falcon
    • Carbon Black
    • Trend Micro Vision One / Apex One
  • Perform health checks, upgrades, troubleshooting, and lifecycle management.
  • Configure prevention policies, detection rules, IOC/IOA indicators, device control, and endpoint security baselines.
  • Fine-tune EDR policies to minimize false positives while maintaining effective detection coverage.
  • Perform endpoint containment, host isolation, malware remediation, and forensic support during security incidents.
  • Support endpoint onboarding, offboarding, RBAC configuration, and policy management.
  • Integrate EDR platforms with SIEM, SOAR, Identity, and Threat Intelligence solutions.
• NDR Platform Administration
  • Deploy, configure, administer, and maintain Network Detection & Response platforms including:
    • Vectra AI
    • ExtraHop Reveal(x)
  • Configure sensors, packet capture, metadata collection, and monitoring infrastructure. Tune AI-based detections and behavioural analytics. Investigate suspicious network activities including lateral movement, command-and-control communications, ransomware, insider threats, and credential abuse. Integrate NDR platforms with SIEM, SOAR, EDR, and Threat Intelligence platforms. Perform platform health monitoring, upgrades, and capacity management.
• Design and implement integrations between EDR, NDR, SIEM, SOAR, Threat Intelligence Platforms, Active Directory, Microsoft Entra ID, and ITSM platforms.
• Develop automation workflows using APIs and scripting to improve operational efficiency.
• Create and maintain architecture diagrams, technical documentation, SOPs, and operational runbooks.
• Support customer onboarding, migration, and platform integration projects.
• Validate telemetry collection, data quality, and event visibility across integrated security platforms.
• Threat Detection & Security Operations
  • Work closely with SOC and Incident Response teams to investigate and respond to security incidents.
  • Conduct threat hunting using endpoint, network, and SIEM telemetry.
  • Develop and improve detection use cases aligned with the MITRE ATT&CK framework.
  • Participate in purple team exercises, adversary emulation, and continuous improvement initiatives.
  • Recommend security improvements based on emerging threats and incident findings.
• Operational Responsibilities
  • Perform platform upgrades, patching, backup validation, and preventive maintenance.
  • Monitor platform health, licensing, storage, and overall performance.
  • Maintain technical documentation, SOPs, and knowledge base articles.
  • Provide technical mentoring and guidance to junior engineers and SOC analysts.
  • Participate in after‑hours maintenance and critical incident support when required.

Qualifications & Skills

• Minimum 5–7 years of experience in cybersecurity engineering or security operations.
• Minimum 4 years of hands‑on experience administering enterprise EDR platforms.
• Minimum 3 years of experience administering NDR platforms.

Preferred Certifications

VMware Carbon Black Administrator

Trend Micro Vision One Professional

Microsoft Certified: Security Operations Analyst (SC‑200)

Microsoft Certified: Azure Security Engineer (AZ‑500)

Splunk Core Certified Power User, Enterprise Security Admin, or Microsoft Sentinel certification (preferred)

• CISSP, GCIH, GCED, CySA+, Security+, or equivalent
• Working knowledge of SIEM platforms, preferably Splunk Enterprise Security and/or Microsoft Sentinel, including data onboarding, alert tuning, dashboards, and investigations.
• Experience supporting enterprise security platforms within a SOC or Managed Security Services (MSS) environment.
• EDR
  • Microsoft Defender for Endpoint
  • CrowdStrike Falcon
  • VMware Carbon Black Cloud
  • Trend Micro Vision One / Apex One
• NDR
  • Vectra AI
  • ExtraHop Reveal(x)
• SIEM
  • Splunk Enterprise / Splunk Enterprise Security
  • Microsoft Sentinel
  • Basic knowledge of KQL and SPL
  • Log onboarding and normalization
  • Correlation rule developmentDashboard creation
  • Alert tuning
  • Data connector troubleshooting
• Strong understanding of:
  • Endpoint Security
  • Network Security
  • Incident Response
  • Threat Hunting
  • Detection Engineering
  • MITRE ATT&CK Framework
  • IOC/IOA Management
  • Malware Analysis
  • Windows and Linux Security
  • Active Directory & Microsoft Entra ID
  • Networking (TCP/IP, DNS, VPN, Firewalls)
  • REST APIs
  • PowerShell and/or Python scripting
• Health insurance with one of the leading global providers for medical insurance.

Career progression and growth through challenging projects and work.

Employee engagement and wellness campaigns activities throughout the year.

Excellent learning and development opportunities.

Inclusive and diverse working environment.

Flexible/Hybrid working environment.

About Us

Help AG, the cybersecurity arm of e&, is the Middle East's trusted cybersecurity partner, enabling governments, enterprises and critical industries to innovate with confidence. Combining strategic consulting, advanced managed security services and deep technology expertise, Help AG helps organisations strengthen cyber resilience, secure AI adoption and build trusted sovereign digital environments. With regional expertise and a customer-first approach, Help AG delivers end-to-end cybersecurity capabilities designed to protect critical operations, manage evolving risks and support secure digital transformation. Through continuous innovation, trusted partnerships and measurable outcomes, Help AG enables organisations to remain resilient, prepared and confident in a complex digital world.