Lead SOC Analyst

KalSoft; Doha; On-site; QAR 180,000 - 300,000; Full time

Job summary

KalSoft is seeking a Lead SOC Analyst to lead security monitoring, threat detection, investigation, and incident response for AI agents and agentic platforms across the Microsoft ecosystem in Doha. You will oversee AI security monitoring, incident response, compliance, and containment activities in a 24/7 SOC environment.

Requirements include a 5+ year track record in SOC/IR, hands-on MS Sentinel/Defender XDR, Purview, Entra ID, CAE, and PIM, plus strong KQL and cloud security expertise.

Qualifications

• Bachelor's degree in a relevant discipline.
• 5+ years in SOC/Security Operations, MSSP, or Incident Response.
• Hands-on with Microsoft Sentinel, Defender XDR, Purview, Entra ID, CAE, and PIM.
• Experience investigating identity-based attacks, cloud security incidents, and authorization issues.
• Experience creating, tuning, and maintaining detection rules and workflows.
• Experience supporting security monitoring in cloud-native and Microsoft security environments.
• Experience in a 24/7 security operations environment.
• Proficiency in KQL for threat hunting and investigation.
• Understanding RBAC, PAM, least privilege, and identity governance.
• Knowledge of AI security tech including Microsoft Copilot Studio, Microsoft 365 Agents, Azure AI Foundry.
• Familiarity with OWASP Top 10 for LLM, MITRE ATLAS, and NIST AI RMF.

Responsibilities

• Monitor AI agents and agentic platforms across Microsoft 365, Purview, Defender XDR, Entra ID, Sentinel, and Azure AI Foundry.
• Detect, investigate, and respond to AI-related threats including takeover, privilege drift, prompt injection, and shadow agents.
• Conduct security incident triage, investigation, and escalation per SOC procedures.
• Execute containment and remediation actions such as token revocation, CA enforcement, and agent quarantine.
• Develop, maintain, and tune detection use cases, analytics rules, and monitoring content in Sentinel and Defender XDR.
• Manage agent risk classifications, evidence repositories, audit records, and compliance docs.
• Perform assurance reviews, security validations, and control testing for governance compliance.
• Track detection, response, and containment SLAs, KPIs, and KRIs.
• Collaborate with client security, identity, governance, Microsoft support, and AI owners for threat response.
• Support threat hunting and ongoing improvement of AI security monitoring capabilities.
• Develop and maintain playbooks, incident response procedures, and runbooks for AI security events.
• Participate in a 24/7 rota and on-call support for continuous security monitoring.

Skills

KQL

RBAC

PIM

Threat Hunting

Incident Response

Cloud Security

Security Monitoring

Communication

Education

Bachelor's degree in a relevant discipline

Tools

Microsoft Sentinel

Microsoft Defender XDR

Microsoft Purview

Microsoft Entra ID

Azure AI Foundry

Conditional Access (CAE)

Privileged Identity Management (PIM)

Job description

Location: Onsite – Doha, Qatar
Experience: 5+ Years
Employment Type: Full-Time

About the Role

KalSoft is looking for a Lead SOC Analyst to lead security monitoring, threat detection, investigation, and incident response for AI agents and agentic platforms across the Microsoft ecosystem. The role focuses on securing Microsoft 365, Microsoft Purview, Microsoft Defender, Microsoft Entra ID, Microsoft Sentinel, and Azure AI Foundry. The candidate will oversee AI security monitoring, incident response, compliance, and containment activities while collaborating with security, identity, governance, and business teams in a 24/7 SOC environment.

Key Responsibilities

• Monitor AI agents and agentic platforms across Microsoft 365 Agents, Microsoft Purview, Microsoft Defender XDR, Microsoft Entra ID, Microsoft Sentinel, and Azure AI Foundry
• Detect, investigate, and respond to AI-related security threats, including:
  • Agent takeover and account compromise
  • Privilege drift and excessive permissions
  • Prompt injection attacks and data poisoning
  • Shadow or unauthorized AI agents
  • Suspicious agent behaviour and anomalous activity
• Conduct security incident triage, investigation, and escalation in accordance with SOC procedures
• Execute approved containment and remediation actions, including access token revocation, Conditional Access enforcement, agent suspension or quarantine, and privileged access restrictions
• Develop, maintain, and fine-tune detection use cases, analytics rules, and monitoring content in Microsoft Sentinel and Defender XDR
• Manage agent risk classifications, security certifications, evidence repositories, audit records, and compliance documentation
• Conduct recurring assurance reviews, security validations, and control testing to ensure agents comply with governance requirements
• Track and report detection, response, and containment SLAs, KPIs, and KRIs
• Collaborate with client security teams, identity administrators, governance and compliance teams, Microsoft support, and AI agent owners to coordinate threat response and risk mitigation
• Support threat hunting and continuous improvement of AI security monitoring capabilities
• Develop and maintain playbooks, incident response procedures, and operational runbooks for AI-related security events
• Participate in a 24/7 operational rota and on-call support for continuous security monitoring and incident response

Requirements

• Bachelor's degree in a relevant discipline
• 5+ years of experience in SOC, Security Operations, Managed Security Services (MSSP), Cyber Defence, or Incident Response environments
• Hands-on experience with:
  • Microsoft Sentinel and Microsoft Defender XDR
  • Microsoft Purview and Microsoft Entra ID
  • Conditional Access and Continuous Access Evaluation (CAE)
  • Privileged Identity Management (PIM)
• Experience investigating identity-based attacks, authorization issues, insider threats, and cloud security incidents
• Practical experience creating, tuning, and maintaining detection rules, alerts, and investigation workflows
• Experience supporting security monitoring in cloud-native and Microsoft security environments
• Experience working in a 24/7 security operations environment
• Strong proficiency in Kusto Query Language (KQL) for threat hunting, monitoring, and investigation
• Strong understanding of Role-Based Access Control (RBAC), Privileged Access Management (PAM), least privilege principles, and identity and access governance
• Knowledge of AI security technologies and platforms, including:
  • Microsoft Copilot Studio
  • Microsoft 365 Agents (Agent 365)
  • Azure AI Foundry
  • Agent governance and lifecycle management
• Familiarity with AI and agentic security frameworks and standards, including:
  • OWASP Top 10 for LLM Applications and Agentic Security
  • MITRE ATLAS
  • NIST AI Risk Management Framework (AI RMF)
• Strong understanding of cloud security, threat detection methodologies, and incident response best practices
• Excellent analytical, problem-solving, and decision-making skills, particularly during active security incidents
• Strong documentation, evidence collection, audit support, and reporting skills
• Excellent verbal and written communication skills, with the ability to engage technical and non-technical stakeholders
• Ability to manage priorities and respond effectively in high-pressure operational environments
• Commitment to continuous learning in AI security and cyber defence
• Willingness to participate in a 24/7 operational support model and on-call rota