Defense Engineer - System Operator (RE)

Innovative Solutions; Riyadh; On-site; SAR 250,000 - 380,000; Full time

Job summary

Innovative Solutions is seeking a Defense Engineer – System Operator to continuously monitor threats and incidents across company systems. You will detect, analyze, document, and respond to cybersecurity events, maintaining system security and integrity.

The role emphasizes incident response, coordination with stakeholders, and adherence to established procedures. Strong experience with SIEM/EDR, incident reporting, and regulatory channels is required.

Qualifications

• Minimum 5+ years in cybersecurity, security operations, or related field.
• Certifications CISSP or CASP+, and CCNA are required.
• Strong knowledge of monitoring, threat detection, incident investigation and response.
• Hands-on experience with SIEM, EDR/AV, WAF, firewalls, NAC, proxy, HX, IDS/IPS, databases, and endpoint security.

Responsibilities

• Monitor and manage cybersecurity systems and security controls including EDR, AV, SIEM, WAF, Firewall, NAC, Proxy, and HX.
• Continuously monitor alerts, classify incidents by severity, and take action.
• Assess incidents and follow incident response procedures: notify owners, initiate actions, escalate, document.
• Investigate incidents and cyberattacks and analyze security events and indicators.
• Document, track, and report incidents per procedures.
• Handle Service Requests related to information security.
• Create and update security use cases for existing and new systems.
• Report incidents through Saudi Cybersecurity Authority channels when applicable.
• Conduct regular security scans to identify vulnerabilities and threats.
• Ensure compliance with cybersecurity standards and IT policies.
• Coordinate with departments during investigations and incident response.
• Prepare monthly reports on major incidents, findings, and actions.

Skills

Cybersecurity Monitoring

Security Operations

Security Incident Response

Threat Detection

Incident Investigation

Documentation

Communication

Tools

SIEM

EDR/AV

WAF

Firewalls

NAC

Proxy

HX

IDS/IPS

Databases

Endpoint security

Job description

Company Overview

Innovative Solutions (IS) is a leading Cybersecurity company established in 2003, with its headquarters in Riyadh and additional offices in Al Khobar, Jeddah, Dubai, and Abu Dhabi. We specialize in delivering Comprehensive Cybersecurity Solutions and Services encompassing Advisory Services, Technical Assurance, Solution Deployment, Professional Services, and Managed Security Services.

Our mission is "Delivering secure and intelligent digital services that empower organizations"

Role Summary

The Defense Engineer – System Operator (RE) is responsible for continuously monitoring cybersecurity threats and security incidents across the company's systems. The role focuses on detecting, analyzing, documenting, and responding to cybersecurity incidents while maintaining the security and integrity of the company's systems and information.

Key Responsibilities

• Monitor and manage cybersecurity systems and security controls, including EDR, AV, SIEM, WAF, Firewall, NAC, Proxy, and HX.
• Continuously monitor security alerts and events, classify incidents based on severity and impact, and take appropriate action.
• Assess security incidents and follow established incident response procedures, including:
• Notifying relevant system owners.
• Initiating appropriate incident response actions.
• Escalating incidents according to defined procedures.
• Documenting incident details, findings, and actions taken.
• Investigate cybersecurity incidents and cyberattacks and analyze relevant security events and indicators.
• Document, track, and report cybersecurity incidents in accordance with established procedures.
• Handle and follow up on users' Service Requests related to information security.
• Create, develop, and update security use cases for existing and newly implemented security systems and applications.
• Analyze cybersecurity incidents and security events and report them through the Saudi Cybersecurity Authority channels, where applicable.
• Conduct regular security scans to identify vulnerabilities, security gaps, and potential threats.
• Ensure compliance with applicable cybersecurity standards, policies, and requirements approved by the Information Technology Administration.
• Coordinate with relevant departments and system owners during cybersecurity investigations and incident response activities.
• Prepare monthly reports summarizing major cybersecurity incidents, findings, trends, and actions taken.
• Maintain and operate security systems and ensure they are updated to the latest approved versions.
• Identify, classify, and prioritize security events and incidents collected through security controls, including firewalls, network and proxy devices, IDS/IPS systems, antivirus solutions, databases, and endpoints.
• Support the continuous improvement of security monitoring, incident detection, and response processes.
• Perform other cybersecurity monitoring, investigation, and incident response duties as assigned.

Qualifications & Experience

• Minimum Experience: 5+ years of relevant experience in cybersecurity, security operations, or a related field.
• Required Certifications: CISSP or CASP+ and CCNA.
• Strong knowledge of cybersecurity monitoring, threat detection, incident investigation, and incident response.
• Hands-on experience with security monitoring and protection technologies, including SIEM, EDR/AV, WAF, Firewalls, NAC, Proxy, HX, IDS/IPS, databases, and endpoint security solutions.
• Ability to analyze security alerts and events, assess risks, prioritize incidents, and follow established incident response procedures.
• Knowledge of vulnerability assessment, security scanning, and cybersecurity controls.
• Strong analytical, problem-solving, documentation, reporting, communication, and coordination skills.

Core Competencies

• Cybersecurity Monitoring
• Security Operations
• Security Incident Response
• Threat Detection and Analysis
• Security Information and Event Management (SIEM)
• Vulnerability Assessment and Security Scanning
• Cybersecurity Investigation
• Incident Documentation and Reporting
• Risk Assessment and Incident Classification
• Security Controls Management
• Cross-functional Communication