Senior Security Operations Engineer (SIEM/SOAR)

Dicetek LLC; Abu Dhabi; On-site; AED 260,000 - 420,000; Full time

Job summary

Dicetek LLC in Abu Dhabi, United Arab Emirates, seeks an experienced SIEM security engineer to design, implement, and optimize SIEM architectures. You will craft complex correlation rules for QRadar and Microsoft Sentinel, automate incident response with SOAR playbooks, and lead proactive threat hunting across regulated environments.

The role requires 5–10 years in security operations, Azure and XDR familiarity, and strong scripting abilities in PowerShell or Python.

Qualifications

• 5–10 years of experience in security operations or SIEM engineering.
• Hands-on experience deploying IBM QRadar components and rules.
• Strong Microsoft Sentinel skills: workspace design, connectors, analytics.
• Proficient in KQL; working knowledge of AQL.
• Experience building SOAR playbooks and security automation.
• Solid understanding of log sources, parsing and data pipelines.
• Knowledge of MITRE ATT&CK framework and detection engineering.
• Experience with Azure, Defender XDR and Entra ID; scripting in PowerShell/Python.

Responsibilities

• Design, implement, and maintain advanced SIEM architectures for performance and scalability.
• Develop and tune complex SIEM correlation rules and alerts to minimize false positives.
• Engineer and deploy SOAR playbooks to automate incident response workflows.
• Lead threat hunting to identify APTs and novel attack vectors.

Skills

SIEM engineering

Threat hunting

KQL

AQL

SOAR playbooks

PowerShell

Python

Tools

IBM QRadar

Microsoft Sentinel

Azure

Microsoft Defender XDR

Entra ID

ARM

Bicep

Terraform

Job description

• Design, implement, and maintain advanced SIEM architectures, ensuring optimal performance and scalability for detecting sophisticated threats.
• Develop and tune complex SIEM correlation rules and alerts to minimize false positives and maximize the detection of critical security incidents.
• Engineer and deploy SOAR playbooks to automate incident response workflows, reducing manual effort and accelerating containment.
• Lead threat hunting initiatives by proactively searching for and identifying advanced persistent threats (APTs) and novel attack vectors within the environment.

Desired Candidate Profile

Essential Requirements

• 5–10 years' experience in security operations, SIEM engineering or a related cyber security role.

• Proven hands-on experience deploying and configuring IBM QRadar (DSM configuration, custom properties, rules, reference data, apps).

• Strong hands-on experience with Microsoft Sentinel: workspace design, data connectors, analytics rules, workbooks and automation.

• Strong KQL skills, plus working knowledge of AQL.

• Practical experience building SOAR playbooks and security automation.

• Sound understanding of log sources, parsing, normalisation and data pipelines (Syslog, CEF, AMA, DCRs, APIs).

• Good knowledge of the MITRE ATT&CK framework and detection engineering principles.

• Working knowledge of Azure, Microsoft Defender XDR and Microsoft Entra ID.

• Scripting ability in PowerShell and/or Python.

Highly Desirable

• SIEM migration experience, particularly QRadar to Microsoft Sentinel.

• Banking or financial services experience, including familiarity with regulatory expectations for security monitoring (e.g., CBUAE, PCI DSS, SWIFT CSP).

• Experience in large, regulated or 24x7 SOC environments.

• Infrastructure-as-code experience for Sentinel deployment (ARM, Bicep, Terraform) and CI/CD for detection content.

• Experience integrating threat intelligence platforms and EDR tools.

Certifications (Preferred)

• Microsoft Certified: Security Operations Analyst Associate (SC-200)

• IBM Certified QRadar SIEM Administrator / Deployment Professional

• Relevant industry certifications such as GIAC (GCIA, GCIH, GCDA), CISSP or equivalent