SOC Specialist_L3

Cyber Gate Defense; United Arab Emirates; On-site; AED 240,000 - 420,000; Full time

Job summary

Cyber Gate Defense seeks an experienced cybersecurity professional to lead investigations and containment of advanced incidents. You will analyze alerts, triage threats, and coordinate responses across IT, network, cloud, and endpoint security teams.

A strong focus on QRadar and Splunk, with proficiency in AQL and SPL, is required. Responsibilities include developing incident reports, executive summaries, and post-incident reviews, while applying MITRE ATT&CK mappings and threat intelligence to

Qualifications

• Bachelor's degree or equivalent practical experience in cybersecurity or related field.
• Hands-on experience in cybersecurity or SOC operations with incident response focus.
• Proficiency with IBM QRadar and Splunk SIEM.
• Strong knowledge of QRadar AQL and Splunk SPL.
• Knowledge of Windows, Linux, Active Directory, DNS, HTTP/S, TCP/IP, VPNs, firewalls, proxies, and endpoint security.
• Experience investigating phishing, malware, ransomware, privilege escalation, lateral movement, and data exfiltration.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain, and incident response methodologies.
• Experience with EDR/XDR platforms, threat intelligence, and vulnerability management.

Responsibilities

• Lead the investigation and resolution of complex security incidents escalated by L1 and L2 SOC teams.
• Perform detailed analysis of security alerts, events, and logs to identify advanced threats and malicious activities.
• Conduct incident triage, root cause analysis, impact assessment, containment, eradication, and recovery.
• Investigate advanced persistent threats (APTs), ransomware, malware infections, insider threats, and account compromises.
• Coordinate incident response activities with IT infrastructure, network, cloud, endpoint, and application security teams.
• Develop detailed incident reports, executive summaries, and post-incident reviews.

Skills

QRadar SIEM

Splunk SIEM

AQL

SPL

Threat hunting

Incident response

MITRE ATT&CK

EDR/XDR platforms

Network security

Windows/Linux security

Education

Bachelor's degree in Computer Science, Information Security, or a related field

Tools

IBM QRadar

Splunk

Job description

Advanced Security Monitoring and Incident Response

• Lead the investigation and resolution of complex security incidents escalated by L1 and L2 SOC teams.
• Perform detailed analysis of security alerts, events, and logs to identify advanced threats and malicious activities.
• Conduct incident triage, root cause analysis, impact assessment, containment, eradication, and recovery.
• Investigate advanced persistent threats (APTs), ransomware, malware infections, insider threats, and account compromises.
• Coordinate incident response activities with IT infrastructure, network, cloud, endpoint, and application security teams.
• Develop detailed incident reports, executive summaries, and post-incident reviews.

2. IBM QRadar SIEM

• Administer and optimize IBM QRadar SIEM monitoring and detection capabilities.
• Develop, tune, and maintain QRadar correlation rules, building blocks, and custom rules.
• Investigate offenses by analyzing event and flow data, log sources, and correlated security events.
• Perform advanced searches using QRadar Ariel Query Language (AQL).
• Identify false positives and improve detection accuracy through rule tuning and offense prioritization.
• Onboard and troubleshoot log sources, DSM parsing, event categorization, and normalization.
• Develop dashboards, reports, and use cases aligned with MITRE ATT&CK techniques.
• Monitor QRadar health, event ingestion, EPS/FPM utilization, and data collection issues.

3. Splunk SIEM and Security Analytics

• Develop and optimize advanced Splunk Search Processing Language (SPL) queries for threat detection and investigation.
• Create and maintain correlation searches, alerts, dashboards, reports, and security use cases.
• Investigate suspicious activities using authentication, endpoint, network, DNS, proxy, firewall, and cloud logs.
• Develop detection content and scheduled searches using Splunk Enterprise Security where deployed.
• Tune detections to reduce false positives and improve alert fidelity.
• Troubleshoot data ingestion, sourcetypes, field extractions, parsing, indexing, and search performance.
• Leverage risk-based alerting, risk scores, and notable events where supported by the deployed Splunk ES configuration.
• Create reusable SPL searches for incident investigations, threat hunting, and forensic analysis.

4. Threat Hunting and Detection Engineering

• Conduct proactive threat hunting across SIEM, EDR, network, identity, and cloud telemetry.
• Map adversary behaviors and detections to the MITRE ATT&CK framework.
• Analyze indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs).
• Develop and enhance detection rules based on emerging threats and threat intelligence.
• Perform hypothesis-driven investigations to identify stealthy or previously undetected threats.
• Validate detection coverage and recommend improvements to security monitoring.

Role & responsibilities

Preferred candidate profile

• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• Typically 58 years of experience in cybersecurity or SOC operations, including substantial hands-on incident response experience.
• Strong hands-on expertise in IBM QRadar and Splunk SIEM.
• Advanced knowledge of QRadar AQL and Splunk SPL.
• Strong understanding of Windows, Linux, Active Directory, DNS, HTTP/S, TCP/IP, VPNs, firewalls, proxies, and endpoint security.
• Experience investigating phishing, malware, ransomware, privilege escalation, lateral movement, and data exfiltration.
• Knowledge of MITRE ATT&CK, the Cyber Kill Chain, and incident response methodologies.
• Experience with EDR/XDR platforms, threat intelligence, and vulnerability