Senior SOC Analyst - Proactive Threat Hunter & AI-Driven Defender

Deriv; Dubai; On-site; AED 260,000 - 420,000; Full time

Job summary

Deriv in Dubai seeks a senior security hunter to shift from reactive alerts to proactive threat detection across our live trading platform. You’ll own incidents end to end and build detections aligned to MITRE ATT&CK.

Work spans infrastructure, cloud, identity and endpoint, collaborating with Red Team and the AI agent stack to protect critical assets while shaping the future of security engineering at a company that processes real money and real regulations.

Qualifications

• 6+ years in a SOC, threat hunting, or DFIR with incident ownership.
• GCFA, GCIH, GCIA, or equivalent credential strongly preferred.
• Deep experience in EDR internals, cloud security monitoring (AWS/GCP), network forensics, malware analysis, SIEM, and detection‑as‑code.
• Ability to write detection logic and tooling in Python or a proper query language.
• Think like an attacker to catch threats and avoid blind spots.
• Ability to produce actionable incident reports.

Responsibilities

• Hunt proactively across infrastructure, cloud, identity, and endpoint.
• Build and tune detections mapped to MITRE ATT&CK.
• Own incidents end to end: triage, containment, root cause, and reporting.
• Push back on tuning decisions that trade visibility for noise reduction.
• Partner with Red Team on purple‑team exercises.
• Extend detection into the AI agent stack and address prompt injection issues.
• Conduct malware analysis and reverse engineering at a practical level.
• Mentor junior analysts and raise the triage bar.

Skills

Threat hunting

SOC

Incident ownership

Python scripting

Detection engineering

MITRE ATT&CK

Education

GCFA, GCIH, GCIA or equivalent

Tools

EDR internals

Cloud security monitoring (AWS/GCP)

Network forensics

Malware analysis

SIEM and detection‑as‑code

Identity threat hunting

Job description

Deriv in Dubai seeks a senior security hunter to shift from reactive alerts to proactive threat detection across our live trading platform. You’ll own incidents end to end and build detections aligned to MITRE ATT&CK.

Work spans infrastructure, cloud, identity and endpoint, collaborating with Red Team and the AI agent stack to protect critical assets while shaping the future of security engineering at a company that processes real money and real regulations.