Lead AI Security SOC Analyst (Microsoft 365/Azure)

KalSoft; Doha; On-site; QAR 180,000 - 300,000; Full time

Job summary

KalSoft is seeking a Lead SOC Analyst to lead security monitoring, threat detection, investigation, and incident response for AI agents and agentic platforms across the Microsoft ecosystem in Doha. You will oversee AI security monitoring, incident response, compliance, and containment activities in a 24/7 SOC environment.

Requirements include a 5+ year track record in SOC/IR, hands-on MS Sentinel/Defender XDR, Purview, Entra ID, CAE, and PIM, plus strong KQL and cloud security expertise.

Qualifications

• Bachelor's degree in a relevant discipline.
• 5+ years in SOC/Security Operations, MSSP, or Incident Response.
• Hands-on with Microsoft Sentinel, Defender XDR, Purview, Entra ID, CAE, and PIM.
• Experience investigating identity-based attacks, cloud security incidents, and authorization issues.
• Experience creating, tuning, and maintaining detection rules and workflows.
• Experience supporting security monitoring in cloud-native and Microsoft security environments.
• Experience in a 24/7 security operations environment.
• Proficiency in KQL for threat hunting and investigation.
• Understanding RBAC, PAM, least privilege, and identity governance.
• Knowledge of AI security tech including Microsoft Copilot Studio, Microsoft 365 Agents, Azure AI Foundry.
• Familiarity with OWASP Top 10 for LLM, MITRE ATLAS, and NIST AI RMF.

Responsibilities

• Monitor AI agents and agentic platforms across Microsoft 365, Purview, Defender XDR, Entra ID, Sentinel, and Azure AI Foundry.
• Detect, investigate, and respond to AI-related threats including takeover, privilege drift, prompt injection, and shadow agents.
• Conduct security incident triage, investigation, and escalation per SOC procedures.
• Execute containment and remediation actions such as token revocation, CA enforcement, and agent quarantine.
• Develop, maintain, and tune detection use cases, analytics rules, and monitoring content in Sentinel and Defender XDR.
• Manage agent risk classifications, evidence repositories, audit records, and compliance docs.
• Perform assurance reviews, security validations, and control testing for governance compliance.
• Track detection, response, and containment SLAs, KPIs, and KRIs.
• Collaborate with client security, identity, governance, Microsoft support, and AI owners for threat response.
• Support threat hunting and ongoing improvement of AI security monitoring capabilities.
• Develop and maintain playbooks, incident response procedures, and runbooks for AI security events.
• Participate in a 24/7 rota and on-call support for continuous security monitoring.

Skills

KQL

RBAC

PIM

Threat Hunting

Incident Response

Cloud Security

Security Monitoring

Communication

Education

Bachelor's degree in a relevant discipline

Tools

Microsoft Sentinel

Microsoft Defender XDR

Microsoft Purview

Microsoft Entra ID

Azure AI Foundry

Conditional Access (CAE)

Privileged Identity Management (PIM)

Job description

KalSoft is seeking a Lead SOC Analyst to lead security monitoring, threat detection, investigation, and incident response for AI agents and agentic platforms across the Microsoft ecosystem in Doha. You will oversee AI security monitoring, incident response, compliance, and containment activities in a 24/7 SOC environment.

Requirements include a 5+ year track record in SOC/IR, hands-on MS Sentinel/Defender XDR, Purview, Entra ID, CAE, and PIM, plus strong KQL and cloud security expertise.