Senior Security Operations Engineer

Digital Zone; United Arab Emirates; On-site; AED 260,000 - 420,000; Full time

Benefits offered by this job

Top-of-the-market compensation

High-impact scope

Regional collaboration with Talabat, C

Job summary

Digital Zone is hiring its first Security Operations lead to own threat detection and incident response end-to-end. You’ll design logs, alerts, and playbooks for a cloud-native platform, partnering with engineering and product security to measure and improve detection and containment.

You’ll build data pipelines, tune SIEM/EDR tooling, and codify detections to reduce noise while maximizing impact. A startup/scale-up mindset and strong communication under pressure are essential.

Qualifications

• 5+ years in security operations, detection engineering or incident response
• Experience building detections and investigations in cloud environments
• Hands-on coding and automation to reduce alert fatigue

Responsibilities

• Design and operate security operations across cloud, identity, endpoint and SaaS
• Build and maintain data pipelines to ingest logs into SIEM/data lake
• Own SIEM, EDR, and cloud threat detection tooling
• Develop detections mapped to MITRE ATT&CK and test coverage
• Lead incident response and run blameless post-incident reviews

Skills

Security operations

Threat detection

Incident response

SIEM

Cloud security

Python

SQL

Threat hunting

Automation

Tools

CloudTrail

GuardDuty

VPC Flow Logs

Kubernetes audit logs

EDR

SOAR

Job description

About The Role

We're a rapidly scaling digital goods company, and security operations is a function you'll shape, not just run. As our first Security Operations hire, you'll own threat detection and incident response from start to finish: what we log, what we alert on, and how we respond when something happens. You'll work closely with engineering and our Product Security function to protect our cloud-native platform, and you'll improve our ability to spot and contain threats in ways we can measure. This is a high-impact role with plenty of autonomy. It suits someone who enjoys building security operations from first principles in a modern, fast-moving environment.

About The Role

We're a rapidly scaling digital goods company, and security operations is a function you'll shape, not just run. As our first Security Operations hire, you'll own threat detection and incident response from start to finish: what we log, what we alert on, and how we respond when something happens. You'll work closely with engineering and our Product Security function to protect our cloud-native platform, and you'll improve our ability to spot and contain threats in ways we can measure. This is a high-impact role with plenty of autonomy. It suits someone who enjoys building security operations from first principles in a modern, fast-moving environment.

What You’ll Do

• Build and run core detection and response capabilities: Design and operate our security operations across cloud, identity, endpoint and SaaS, from threat detection and threat hunting through to incident response
• Build security data pipelines: Design and build the pipelines that bring logs from cloud, identity, endpoint and SaaS sources into our SIEM or security data lake. Normalize and enrich the data at ingestion, monitor pipeline health so a broken log source is caught quickly, and balance coverage against cost and retention requirements
• Own our security operations tooling: Select, deploy, configure and tune the SIEM, EDR, cloud threat detection and automation tooling so it raises alerts with a high signal to noise ratio
• Build detections that matter: Write detections as code, map them to MITRE ATT&CK and base them on how attackers would realistically target our environment. Measure and test coverage, and focus effort where the risk is highest
• Lead incident response: Own the incident response plan and playbooks. Act as incident commander for security events and coordinate containment and recovery across engineering, legal and leadership. Run blameless PIRs that leave us stronger

Requirements

• Senior experience: Typically 5+ years in security operations, detection engineering or incident response, with hands-on experience building things yourself. A startup or scale-up background is a strong plus
• Cloud detection and response ownership: You've built detections and investigated incidents in AWS, using sources like CloudTrail, GuardDuty, VPC Flow Logs and Kubernetes audit logs
• Depth in key security operations domains: You're comfortable taking the lead in at least one (ideally several) of these:
• Detection engineering and detection-as-code
• Incident response and cloud forensics
• SIEM and security data pipeline architecture
• Security automation (SOAR) and alert triage workflows
• Threat hunting and threat intelligence
• Engineering mindset: You write code (Python, SQL or your SIEM's query language), treat detections and runbooks like software, and automate repetitive work so people can focus on judgment calls.
• Calm, clear communication under pressure: You can run an incident and keep stakeholders informed while it's happening. You can turn technical findings into statements of impact and next steps for engineers, leadership, non-technical colleagues and, when needed, customers

Nice to Have

• Experience building the incident response and logging controls needed for SOC 2, ISO 27001 or PCI audits
• Experience managing an MDR or MSSP partner
• Familiarity with breach notification obligations (e.g. UAE PDPL, customer contractual SLAs)
• Experience hiring or mentoring security analysts or engineers as a function grows

If you've ever looked at a wall of untuned alerts and thought, "I could build a detection and response program that actually catches things," this is your chance to do it.

Benefits

• Immediate, large-scale impact on a high-growth business
• Top-of-the-market compensation packages
• Work alongside top regional talent, with team members from Talabat, Careem, Etisalat, and more