Senior Security Engineer EDR & NDR

Client of Salt; Dubai; On-site; AED 250,000 - 450,000; Full time

Benefits offered by this job

Health insurance

Career progression

Wellness initiatives

Inclusive working environment

Flexible & hybrid working

Open-door communication policy

Job summary

Client of Salt seeks a cybersecurity engineer to design, implement, and support security solutions across customer environments in the UAE. You will deploy, configure, and maintain endpoint and network security platforms, while tuning detections and responding to incidents.

The role requires cross‑functional collaboration with customers and teams, and ongoing security improvements.

Qualifications

• 5–7 years in cybersecurity engineering or security operations.
• 4+ years administering enterprise endpoint security platforms.
• 3+ years administering network detection and response platforms.
• Experience in SOC or MSS environments.
• Knowledge of SIEM data onboarding, alert tuning, dashboards and investigations.
• Familiarity with monitoring tools, query languages, log normalization.
• Experience integrating security platforms with identity management and threat intelligence.

Responsibilities

• Deploy, configure, administer and maintain endpoint and network security platforms.
• Tune detection rules and IOC/IOA management.
• Integrate security platforms with SIEM, SOAR, and threat intel.
• Conduct threat hunting and incident response activities.
• Develop automation workflows using APIs and scripting.
• Provide mentoring to junior engineers.
• Support onboarding, migration, deployment projects.

Skills

Endpoint security

Network security

Threat hunting

SIEM

Security monitoring

Incident response

Automation & orchestration

REST APIs

PowerShell/Python scripting

Tools

SIEM platforms

SOAR

Threat intelligence platforms

Identity management systems

Job description

Will be responsible for the design, implementation, administration, optimization and support of cybersecurity solutions across customer environments. The role requires strong technical expertise in deploying, integrating, configuring, and maintaining security platforms while ensuring optimal performance, visibility and protection. The engineer will work closely with cross‑functional teams and customers to deliver high-quality managed security services, support security operations, and contribute to strategic cybersecurity initiatives.

Responsibilities

Security Platform Administration

• Deploy configure administer and maintain enterprise endpoint and network security platforms
• Perform platform health checks upgrades troubleshooting and lifecycle management
• Configure security policies detection rules indicators of compromise IOCs indicators of attack IOAs and security baselines
• Optimize security configurations to minimize false positives while maintaining effective detection coverage
• Support endpoint containment threat remediation forensic investigations and incident response activities
• Manage platform onboarding offboarding access controls role-based access control RBAC and security policies
• Integrate security platforms with SIEM SOAR identity management and threat intelligence solutions

Network Security Monitoring

• Deploy configure administer and maintain network detection and monitoring platforms
• Configure sensors traffic monitoring packet capture metadata collection and supporting infrastructure
• Tune detection rules and behavioral analytics to improve threat visibility
• Investigate suspicious network activities including lateral movement command-and-control communications ransomware insider threats and credential abuse
• Integrate network security platforms with SIEM SOAR endpoint security and threat intelligence solutions
• Perform platform health monitoring upgrades capacity planning and performance optimization

Engineering and Integration

• Design and implement integrations between endpoint security network security SIEM SOAR threat intelligence directory services identity management and IT service management platforms
• Develop automation workflows using APIs and scripting to improve operational efficiency
• Create and maintain architecture diagrams technical documentation standard operating procedures SOPs and operational runbooks
• Support customer onboarding migration deployment and platform integration projects
• Validate telemetry collection data quality and event visibility across integrated security platforms

Threat Detection and Security Operations

• Collaborate with security operations and incident response teams to investigate and respond to security incidents
• Conduct threat hunting using endpoint network and security monitoring data
• Develop and enhance detection use cases aligned with the MITRE ATT amp CK framework
• Participate in purple team exercises adversary emulation and continuous improvement initiatives
• Recommend security enhancements based on emerging threats threat intelligence and incident findings

Operational Responsibilities

• Perform platform upgrades patching backup validation and preventive maintenance
• Monitor platform health licensing storage and overall performance
• Maintain technical documentation SOPs and knowledge base articles
• Provide technical mentoring and guidance to junior engineers and security operations analysts
• Participate in after-hours maintenance and critical incident support when required

Qualifications and Skills

• Minimum 5-7 years of experience in cybersecurity engineering or security operations
• At least 4 years of hands‑on experience administering enterprise endpoint security platforms
• At least 3 years of experience administering network detection and response platforms
• Experience supporting enterprise security platforms within a Security Operations Centre (SOC) or Managed Security Services (MSS) environment
• Working knowledge of SIEM platforms including data onboarding alert tuning dashboard development correlation rules and security investigations
• Familiarity with security monitoring tools query languages log normalization and data connector troubleshooting
• Experience integrating security platforms with identity management threat intelligence automation and incident management solutions

Technical Knowledge

• Endpoint security and protection
• Network security and traffic analysis
• Security incident response and investigation
• Threat hunting and detection engineering
• MITRE ATT amp CK framework
• IOC IOA management
• Malware analysis and remediation
• Windows and Linux security
• Directory services and identity management
• Networking fundamentals including TCP IP DNS VPNs and firewalls
• REST APIs and security platform integrations
• PowerShell and or Python scripting
• Security automation and orchestration
• SIEM data onboarding correlation rules dashboards and alert tuning

Preferred Certifications

• Relevant endpoint security and network security platform certifications
• SIEM and security operations certifications
• Cloud security and security engineering certifications
• Recognized cybersecurity certifications such as CISSP GCIH GCED CySA+ Security+ or equivalent

Benefits

• Health insurance through a leading medical insurance provider
• Career progression and growth opportunities through challenging projects
• Employee engagement and wellness initiatives throughout the yearLearning and professional development opportunities
• Inclusive and diverse working environment
• Flexible and hybrid working arrangements
• Open-door communication policy

Qualifications and Skills (Duplicate)

• Minimum 5-7 years of experience in cybersecurity engineering or security operations. At least 4 years of hands-on experience administering enterprise endpoint security platforms. At least 3 years of experience administering network detection and response platforms. Experience supporting enterprise security platforms within a Security Operations Centre (SOC) or Managed Security Services (MSS) environment. Working knowledge of SIEM platforms, including data onboarding, alert tuning, dashboard development, correlation rules, and security investigations. Familiarity with security monitoring tools, query languages, log normalization, and data connector troubleshooting. Experience integrating security platforms with identity management, threat intelligence, automation, and incident management solutions.
• Technical Knowledge. Endpoint security and protection. Network security and traffic analysis. Security incident response and investigation. Threat hunting and detection engineering. MITRE ATT&CK framework. IOC/IOA management. Malware analysis and remediation. Windows and Linux security. Directory services and identity management. Networking fundamentals, including TCP/IP, DNS, VPNs, and firewalls. REST APIs and security platform integrations. PowerShell and/or Python scripting. Security automation and orchestration. SIEM data onboarding, correlation rules, dashboards, and alert tuning.
• Preferred Certifications. Relevant endpoint security and network security platform certifications. SIEM and security operations certifications. Cloud security and security engineering certifications. Recognized cybersecurity certifications such as CISSP, GCIH, GCED, CySA+, Security+, or equivalent.