Cybersecurity Production Ops Lead (Splunk/SOAR)

TAWANTECH; Riyadh; On-site; SAR 180,000 - 280,000; Full time

Job summary

TAWANTECH is seeking a cybersecurity production support specialist in Riyadh to manage end-to-end platform support for Splunk SIEM, SOAR and VPN infrastructure. You will monitor platforms, respond to alerts, and apply ITIL-based incident/change management practices to ensure high availability.

You will perform root-cause analyses for outages and incidents, optimize log pipelines, automate playbooks, and ensure compliance with SAMA/NCA/PDPL/NDMO data governance.

Qualifications

• Bachelor's degree in cybersecurity, information security, CS or related field.
• 4–8 years of cybersecurity production support experience in banking or financial services.
• Hands-on with Splunk Enterprise/ES, SOAR platforms, and VPN solutions.
• Strong knowledge of SIEM use cases, log management and incident response workflows.
• Experience with ITIL processes including Incident, Problem and Change Management.
• Exposure to SAMA/NCA/PDPL/NDMO controls and data governance frameworks.
• Familiar with DR/BCP planning, execution, and audit requirements.

Responsibilities

• Provide end-to-end production support for cybersecurity platforms including Splunk SIEM, SOAR, and VPN infrastructure.
• Monitor security platforms, dashboards and alerts for continuous operational effectiveness.
• Manage Incident, Problem and Change processes per ITIL standards with timely resolution.
• Perform root cause analysis for outages, performance issues, and security incidents.
• Administer and optimize Splunk use cases, log ingestion pipelines and performance.
• Operate SOAR playbooks, workflows and automation to reduce manual intervention.
• Ensure compliance with SAMA, NCA ECC, PDPL and NDMO data governance requirements.
• Execute DR/BCP activities with regular testing and validation.
• Collaborate with security, infrastructure, and vendors for patching and enhancements.
• Maintain runbooks, SOPs, playbooks, configurations and knowledge base articles.

Skills

ITIL processes

Incident Response

Root cause analysis

Scripting (Python/PowerShell)

Education

Bachelor's degree in Cybersecurity/Info Security/CS

Tools

Splunk Enterprise/ES

Splunk SOAR

Cortex XSOAR

VPN solutions (IPSec/SSL VPN)

Job description

TAWANTECH is seeking a cybersecurity production support specialist in Riyadh to manage end-to-end platform support for Splunk SIEM, SOAR and VPN infrastructure. You will monitor platforms, respond to alerts, and apply ITIL-based incident/change management practices to ensure high availability.

You will perform root-cause analyses for outages and incidents, optimize log pipelines, automate playbooks, and ensure compliance with SAMA/NCA/PDPL/NDMO data governance.