Senior SOC Analyst

Socium - Teams Done Differently; Abu Dhabi; On-site; AED 180,000 - 240,000; Full time

Job summary

Socium - Teams Done Differently in Abu Dhabi is seeking a Senior SOC Analyst (L2/L3) for a fully onsite role. The ideal candidate will have hands-on expertise in IBM QRadar and HP ArcSight, advanced threat detection, incident response, and security investigations.

The successful candidate will strengthen the organisation's Security Operations Centre, lead critical incident investigations, and mentor junior analysts while improving detection capabilities and SOC maturity.

Qualifications

• Proven experience in SOC L2/L3 operations.
• Strong hands-on expertise with IBM QRadar and HP ArcSight.
• Experience in incident response, security investigations, and threat detection.

Responsibilities

• Lead advanced security monitoring and incident investigations.
• Act as primary investigator for high-severity security incidents.
• Develop and tune SIEM correlation rules and detection use cases.
• Mentor and coach Tier 1 analysts on investigations and escalation.
• Prepare incident reports, root cause analyses, and remediation recommendations.
• Coordinate with IT and security teams to ensure timely resolution.

Skills

SOC L2/L3

QRadar

ArcSight

Incident response

Threat detection

Mentoring

Tools

IBM QRadar

HP ArcSight

Job description

Work Setup: Fully Onsite

Role: Senior SOC Analyst – Security Operations & Incident Response

About the Opportunity

We're looking for an experienced Senior SOC Analyst (L2/L3) to join a financial services client in Abu Dhabi.

This role is ideal for a cybersecurity professional with strong hands‑on expertise in IBM QRadar, HP ArcSight, advanced threat detection, incident response, and security investigations.

The successful candidate will play a key role in strengthening the organisation's Security Operations Centre (SOC), improving detection capabilities, leading critical incident investigations, and mentoring junior analysts.

Key Responsibilities

Advanced Security Monitoring & Incident Investigation

• Perform high-fidelity secondary triage, deep-dive alert correlation, and forensic analysis of escalated infrastructure security events.
• Act as the primary investigator for critical and high-severity security incidents, identifying attack vectors, affected systems, and potential business impact.
• Analyse security logs, network traffic, endpoint telemetry, and threat intelligence to identify suspicious activity and emerging threats.
• Investigate complex security incidents and provide actionable findings and remediation recommendations.
• Lead end-to-end incident response workflows, including investigation, containment, eradication, recovery, and post-incident analysis.
• Execute and enhance incident containment and remediation playbooks for confirmed security breaches.
• Coordinate with infrastructure, IT operations, and other technical teams to ensure timely incident resolution.
• Prepare detailed incident investigation reports, root cause analyses, and recommendations for improving security controls.
• Design, develop, maintain, and optimise advanced SIEM correlation rules and threat detection use cases across IBM QRadar and HP ArcSight.
• Continuously evaluate detection thresholds and fine-tune security rules to minimise false positives and improve alert quality.
• Identify detection gaps and implement enhancements to strengthen visibility across enterprise infrastructure.
• Develop and optimise automated response playbooks to improve SOC efficiency and reduce mean time to detect (MTTD) and mean time to respond (MTTR).
• Collaborate with SOC engineering teams to improve threat detection coverage and security monitoring effectiveness.
• Provide technical mentorship and guidance to Tier 1 SOC analysts on alert investigation, incident classification, and escalation procedures.
• Conduct knowledge-sharing sessions and support the development of standard operating procedures and investigation playbooks.
• Review escalated cases to ensure investigation quality, accurate severity classification, and appropriate response actions.
• Support continuous improvement initiatives aimed at strengthening SOC operational maturity.

Stakeholder Coordination & Compliance

• Work closely with IT, infrastructure, risk, and compliance teams on security incidents and remediation activities.
• Support incident documentation, audit requirements, and regulatory reporting obligations relevant to financial services.
• Communicate incident findings, operational risks, and remediation progress to relevant stakeholders.

Required Skills & Experience

• Proven experience in SOC L2/L3 operations, including advanced security monitoring, threat detection, and incident response.
• Strong hands‑on expertise in IBM QRadar and HP ArcSight, including correlation rule development, use-case engineering, and SIEM optimisation.
• Experience investigating complex security incidents involving networks, servers, endpoints, and enterprise infrastructure.
• Solid knowledge of incident response frameworks, security event analysis, and digital forensic investigation methodologies.
• Ability to develop and optimise detection rules, response playbooks, and SOC operational procedures.
• Experience handling high-severity incidents and coordinating remediation across multiple technical teams.
• Strong analytical, troubleshooting, documentation, and stakeholder communication skills.
• Experience mentoring junior analysts and improving SOC investigation practices.

Preferred Qualifications

• Previous experience supporting banking, financial services, or other highly regulated environments.
• Familiarity with MITRE ATT&CK, threat intelligence, and threat hunting methodologies.
• Understanding of financial services cybersecurity compliance and regulatory reporting requirements.
• Relevant cybersecurity certifications such as GCIH, GCFA, GCIA, CySA+, or CISSP would be an advantage.

Interested?

If you have strong hands‑on experience in advanced SOC operations, SIEM engineering, and incident response, we'd love to hear from you.