SOC Engineer

Zohorecruit; Qatar; On-site; QAR 120,000 - 180,000; Full time

Job summary

Black & Grey HR is recruiting for a SOC Engineer in Doha, Qatar to strengthen the security operations center. The role focuses on monitoring, detecting, investigating, and responding to cybersecurity incidents across enterprise IT environments.

Qualified candidates will have 1–4 years in a SOC, experience with SIEM/EDR/NDR, and strong fundamentals in networking and platforms. On-site engagement in Doha with 24x7 operations and incident reporting.

Qualifications

• Bachelor's degree in Cybersecurity, IT, Computer Science or related field.
• 1–4 years hands-on SOC experience with security operations platforms.
• Familiarity with SIEM, EDR/XDR, IDS/IPS, firewalls, and cloud security.

Responsibilities

• Monitor security alerts from SIEM/EDR/NDR and assess incidents by severity and risk.
• Investigate incidents, perform root-cause analysis, and coordinate containment.
• Perform threat hunting, validate indicators of compromise, and improve detections.
• Manage vulnerability progress, patch validation, and incident reporting.
• Maintain incident records, daily reports, and SLA-compliant operations.

Skills

SIEM monitoring

EDR/XDR

NDR

Incident detection

Threat hunting

Vulnerability management

Log analysis

PowerShell/Python/Bash

Documentation

24x7 SOC

Education

Bachelor's degree in Cybersecurity, IT, CS

Job description

Black & Grey HR is recruiting for an established technology solutions and services provider in Doha, Qatar. Our client is seeking a SOC Engineer to strengthen its Security Operations Center (SOC) by monitoring, detecting, investigating, and responding to cybersecurity incidents across enterprise IT environments. This role is ideal for professionals with hands-on SOC experience who are passionate about threat detection, incident response, and maintaining a strong organizational security posture.

Key Responsibilities

Security Monitoring & Incident Detection

• Monitor security alerts generated from SIEM, XDR, EDR, NDR, IDS/IPS, firewalls, and cloud security platforms.
• Identify, validate, triage, and prioritize security incidents based on severity, impact, and business risk.
• Continuously monitor security events to detect malicious activities and potential threats.
• Investigate security incidents and perform root cause analysis.
• Analyze malware, attack techniques, and suspicious activities to determine impact and remediation actions.
• Coordinate containment, eradication, and recovery activities with internal teams.
• Escalate high-severity incidents following established incident response procedures.

Threat Hunting & Detection Engineering

• Perform proactive threat hunting activities using scheduled queries and threat intelligence.
• Monitor threat hunting dashboards and validate suspicious indicators of compromise.
• Identify emerging attack patterns and recommend improvements to detection capabilities.

Vulnerability Management & Security Operations

• Review vulnerability assessment results and monitor remediation progress.
• Validate patch implementation and ensure timely closure of remediation activities.
• Support day-to-day security operations and ensure compliance with operational procedures.

Reporting & Operational Excellence

• Maintain accurate incident records, investigation notes, and ticket updates.
• Prepare daily operational reports, shift handover documentation, and incident summaries.
• Ensure compliance with defined SLAs and operational performance metrics.
• Contribute to continuous improvement of SOC processes and security operations.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• 1–4 years of hands-on experience working in a Security Operations Center (SOC).
• Experience monitoring SIEM, EDR/XDR, IDS/IPS, firewalls, email security, and cloud security platforms.
• Good understanding of incident triage, security event classification, escalation procedures, and ticket management.
• Strong understanding of networking fundamentals including TCP/IP, DNS, HTTP/HTTPS, VPN, routing, switching, and common network protocols.
• Experience working with Windows and Linux operating systems, endpoint security, and system log analysis.
• Knowledge of common cyber threats including phishing, ransomware, malware, brute force attacks, web attacks, and insider threats.
• Preferred certifications:
• CompTIA Security+
• CompTIA CySA+
• EC-Council Certified Network Defender (CND)
• Microsoft SC-200
• Additional certifications such as CHFI or DFIR Foundations will be an advantage.

Required Skillset

• Security Information & Event Management (SIEM) monitoring and alert analysis.
• Endpoint Detection & Response (EDR/XDR) and Network Detection & Response (NDR).
• Incident detection, triage, investigation, and response.
• Threat hunting and threat intelligence analysis.
• Vulnerability management and remediation tracking.
• Log analysis across endpoints, servers, firewalls, proxies, Active Directory, cloud platforms, and security appliances.
• Basic scripting skills using PowerShell, Python, or Bash for automation and log analysis.
• Strong documentation, communication, and incident reporting skills.
• Ability to work in a 24×7 SOC environment and collaborate effectively during security incidents.