Senior Security Operations Engineer (SIEM / SOAR)

Dicetek LLC; Abu Dhabi; On-site; AED 260,000 - 520,000; Full time

Job summary

Dicetek LLC is seeking an experienced security operations professional in Abu Dhabi to lead SIEM engineering efforts. The role emphasizes hands-on QRadar deployment, Microsoft Sentinel configuration, and building robust detection content.

Candidates should demonstrate strong scripting skills (PowerShell/Python) and familiarity with Azure Defender XDR, ATT&CK framework, and security automation through SOAR playbooks.

Qualifications

• 5–10 years' experience in security operations or SIEM engineering.
• Hands-on QRadar deployment and DSM/configuration experience.
• Strong Microsoft Sentinel experience: workspace design, data connectors, analytics rules, workbooks, automation.
• Proficient in KQL and working knowledge of AQL.

Skills

Security operations

Threat detection mindset

Analytical thinking

Incident response

Tools

IBM QRadar

Microsoft Sentinel

KQL

AQL

PowerShell

Python

Azure

Microsoft Defender XDR

Entra ID

Job description

Essential Requirements

• 5–10 years' experience in security operations, SIEM engineering or a related cyber security role.
• Proven hands‑on experience deploying and configuring IBM QRadar (DSM configuration, custom properties, rules, reference data, apps).
• Strong hands‑on experience with Microsoft Sentinel: workspace design, data connectors, analytics rules, workbooks and automation.
• Strong KQL skills, plus working knowledge of AQL.
• Practical experience building SOAR playbooks and security automation.
• Sound understanding of log sources, parsing, normalisation and data pipelines (Syslog, CEF, AMA, DCRs, APIs).
• Good knowledge of the MITRE ATT&CK framework and detection engineering principles.
• Working knowledge of Azure, Microsoft Defender XDR and Microsoft Entra ID.
• Scripting ability in PowerShell and/or Python.

Highly Desirable

• SIEM migration experience, particularly QRadar to Microsoft Sentinel.
• Banking or financial services experience, including familiarity with regulatory expectations for security monitoring (e.g., CBUAE, PCI DSS, SWIFT CSP).
• Experience in large, regulated or 24x7 SOC environments.
• Infrastructure‑as‑code experience for Sentinel deployment (ARM, Bicep, Terraform) and CI/CD for detection content.
• Experience integrating threat intelligence platforms and EDR tools.

Certifications (Preferred)

• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• IBM Certified QRadar SIEM Administrator / Deployment Professional
• Relevant industry certifications such as GIAC (GCIA, GCIH, GCDA), CISSP or equivalent