SOC Analyst – L2 (Security Operations Center)

Dicetek LLC; Abu Dhabi; On-site; AED 150,000 - 270,000; Full time

Job summary

Dicetek LLC is expanding its Security Operations Centre with L1, L2 and L3 resources in Abu Dhabi. The emphasis is on L2 capabilities while maintaining a smaller L1 team and balanced L3 coverage.

The role requires hands-on experience across the Microsoft security ecosystem, with strong emphasis on operational SOC excellence, alert monitoring, investigation, and incident response.

Qualifications

• Minimum 3–5 years hands-on in a Security Operations Center or similar cybersecurity role.
• Experience with Windows/Linux networks and MITRE ATT&CK framework understanding.

Responsibilities

• L1: Monitor, triage, initial investigation, and escalate using defined SLAs and playbooks.
• L2: Lead deeper incident investigation, SIEM analysis, detection tuning, threat analysis, and escalation of high-severity incidents.
• L3: Advanced investigation, detection engineering, log use-case development, SOAR automation, and incident response coordination.

Skills

Microsoft Sentinel

Defender XDR

KQL

SIEM analysis

Threat analysis

SOAR automation

Incident response

L1/L2/L3 SOC

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Microsoft Sentinel

SOAR platforms

EDR/XDR monitoring

NDR/WAF monitoring

Job description

We are looking to augment our internal Security Operations Centre SOC capability with L1 L2 and L3 resources to strengthen operations alongside our existing external Managed Security Service nbsp Our requirement is weighted more towards L2 capability with a smaller number of L1 and balanced L3 resources The focus is on operational SOC analysts with strong hands-on experience across the Microsoft security ecosystem nbsp

Key Capabilities

• strong L1 strong Alert monitoring triage initial investigation and escalation in line with defined SLAs and playbooks
• strong L2 strong Deeper incident investigation SIEM analysis detection rule configuration and tuning threat analysis and escalation of higher-severity incidents
• strong L3 strong Advanced investigation and detection engineering including development and optimisation of log-based use cases strong SOAR automation and orchestration strong complex incident support and technical escalation strong Incident response strong L2 L3 resources should be able to support major incidents including coordinating or acting as incident commander on incident bridges and driving investigations through containment and closure

Core Skills

• strong Strong hands-on experience with strong Microsoft Sentinel Defender XDR KQL and Microsoft security technologies
• Experience across wider SOC capabilities such as strong SOAR EDR XDR NDR WAF DLP PAM email cloud and application security monitoring
• strong is desirable
• Focus strong Hands-on operational SOC capability investigation response and detection improvement strong SIEM administration is not the requirement
• strong Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field; relevant experience may substitute.

Possession of advanced certifications such as CISSP, GCIA, GCIH, or similar demonstrates a commitment to cybersecurity mastery.

Minimum of 3-5 years of hands-on experience in a Security Operations Center or related cybersecurity role, with a proven track record.

Deep understanding of network protocols, operating systems (Windows, Linux), and common attack frameworks (e.g., MITRE ATT&CK).