Senior SOC Threat Hunter — Proactive, AI-Driven Defense

Deriv.com; Dubai; On-site; AED 350,000 - 550,000; Full time

Job summary

Deriv.com, based in Dubai, is seeking a seasoned security professional to lead proactive threat hunting and incident ownership within a Security Operations and AI Engineering context. You will develop detections aligned with MITRE ATT&CK, own end-to-end incidents, and collaborate with Red Team to turn findings into detections.

You will write detection logic in Python, assess noise vs. blind spots, and mentor junior analysts as part of a living, distributed security platform that processes vast

Qualifications

• 6+ years in a SOC, threat hunting, or DFIR role, with real incident ownership, not just alert queue work.
• GCFA, GCIH, GCIA, or equivalent DFIR/detection engineering credential strongly preferred
• Real depth in at least three of: EDR internals and endpoint telemetry, cloud security monitoring (AWS/GCP), network forensics, malware analysis, SIEM and detection-as-code, identity threat hunting
• Comfortable writing your own detection logic and tooling in Python or a proper query language, not copy-pasting from a vendor blog
• You think like an attacker when you write a detection, because that's the only way to catch one
• You know the difference between reducing noise and creating a blind spot, and you've caught that mistake before it cost someone
• You can write a report that gets fixed, not filed

Responsibilities

• Hunt proactively across infrastructure, cloud, identity, and endpoint, working from hypotheses, not just waiting on alerts
• Build, tune, and maintain detections mapped to real attacker TTPs (MITRE ATT&CK), not whatever ships default from the vendor
• Own incidents end to end: triage, containment, root cause, and a report that leads to an actual fix
• Push back on any tuning decision, exclusion, or "known good" assumption that trades visibility for noise reduction, and catch it before it ships
• Partner with Red Team on purple-team exercises, turning every finding into a detection
• Extend detection and monitoring coverage into our AI agent stack: prompt injection, tool misuse, credential exposure in agent workflows
• Do enough malware analysis and reverse engineering to actually understand what you're looking at, not just what a sandbox report says
• Mentor junior analysts and raise the bar on what "triaged" actually means

Skills

Threat hunting

Incident ownership

Python scripting

Detection engineering

EDR internals

Cloud security monitoring

Network forensics

SIEM & detections

Identity threat hunting

Threat intel reasoning

Education

GCFA / GCIA / GCIE credential

Tools

SIEM platforms

EDR tools

Cloud monitoring tools

Job description

Deriv.com, based in Dubai, is seeking a seasoned security professional to lead proactive threat hunting and incident ownership within a Security Operations and AI Engineering context. You will develop detections aligned with MITRE ATT&CK, own end-to-end incidents, and collaborate with Red Team to turn findings into detections.

You will write detection logic in Python, assess noise vs. blind spots, and mentor junior analysts as part of a living, distributed security platform that processes vast