Senior Threat Hunter & SOC Detection Engineer

TALENTMATE; Dubai; On-site; AED 350,000 - 550,000; Full time

Job summary

Deriv is hiring a security engineer in Dubai to proactively hunt threats across infrastructure, cloud, and identity. You will own detections mapped to MITRE ATT&CK, triage incidents end-to-end, and report fixes to reduce risk in a fast-paced production environment.

You will write detection logic in Python, review tuning decisions, and collaborate with Red Team to turn findings into robust detections. This role demands strong DFIR expertise and a proactive, attackers mindset.

Qualifications

• 6+ years in a SOC, threat hunting, or DFIR with real incident ownership.
• GCFA, GCIH, GCIA, or equivalent credential strongly preferred.
• Deep knowledge across EDR internals, cloud security monitoring (AWS/GCP), network forensics, malware analysis, SIEM and detection-as-code.
• Ability to write detection logic and tooling in Python or a proper query language.
• Think like an attacker when writing a detection to catch threats.
• Balance noise reduction with visibility and write actionable reports.

Responsibilities

• Hunt proactively across infrastructure, cloud, identity, and endpoint, based on hypotheses.
• Build, tune, and maintain detections mapped to real attacker TTPs (MITRE ATT&CK).
• Own incidents end to end: triage, containment, root cause, and a fix report.
• Push back on tuning decisions that trade visibility for noise and catch it before it ships.
• Partner with Red Team on purple-team exercises, turning findings into detections.
• Extend detection into our AI agent stack: prompt injection, credential exposure in agent workflows.
• Do malware analysis and reverse engineering to understand threats beyond sandbox reports.
• Mentor junior analysts and raise the bar on triage quality.

Skills

Threat hunting

Incident ownership

Python scripting

EDR basics

Detection engineering

Education

GCFA/GCIH/GCIA cert

Tools

EDR tooling

Cloud security monitoring

SIEM

Detection-as-code

Malware analysis tools

Job description

Deriv is hiring a security engineer in Dubai to proactively hunt threats across infrastructure, cloud, and identity. You will own detections mapped to MITRE ATT&CK, triage incidents end-to-end, and report fixes to reduce risk in a fast-paced production environment.

You will write detection logic in Python, review tuning decisions, and collaborate with Red Team to turn findings into robust detections. This role demands strong DFIR expertise and a proactive, attackers mindset.