Detection Analyst

NourNet; Riyadh; On-site; SAR 180,000 - 300,000; Full time

Job summary

NourNet is seeking an experienced Detection Analyst to join our cybersecurity team in Riyadh. This on-site role focuses on designing and tuning SIEM/XDR detection content to improve threat detection coverage and operational effectiveness.

You will develop and optimize detection rules, dashboards, and reports, analyze alert patterns, and translate threat intelligence into actionable detections. Collaboration with Tier-1/2 SOC and familiarity with MITRE ATT&CK are valued assets.

Qualifications

• 5+ years of experience in SOC operations, detection engineering, or cybersecurity monitoring.
• Advanced experience developing SIEM queries, correlation rules, and detection logic.
• Hands-on experience with SIEM/XDR platforms, alert analysis, and detection optimization.
• Experience with Cortex XSOAR including playbooks, workflows, or integrations is preferred.
• Strong understanding of threat intelligence, incident response, and security event analysis.

Responsibilities

• Develop, maintain, and optimize detection content across SIEM/XDR platforms.
• Analyze alerts and incidents to identify tuning opportunities and gaps.
• Translate threat intel findings into actionable detection rules.
• Perform regression testing and validate functionality of rules.
• Document detection logic, data sources, and tuning history.
• Collaborate with SOC analysts to improve detection effectiveness.
• Map use cases to MITRE ATT&CK and applicable controls.
• Support integration and optimization of detection workflows with Cortex XSOAR.

Skills

Detection engineering

SOC operations

SIEM queries

Correlation rules

Threat intelligence

Incident response

MITRE ATT&CK

Collaboration

Tools

Cortex XSOAR

Job description

We are seeking an experienced Detection Analyst to join our client’s cybersecurity team in Riyadh.

This role is fully on-site at the client’s premises and requires a strong background in SIEM/XDR detection engineering, advanced query development, and security monitoring optimization, with experience in Palo Alto Networks Cortex XSOAR being an advantage.

Role Overview

Primary Objective

Support the Security Detection Lead in designing, developing, implementing, and tuning SIEM/XDR detection content to improve threat detection coverage, accuracy, and operational effectiveness.

Key Responsibilities

Develop, maintain, and optimize correlation rules, detection logic, dashboards, and reports across SIEM/XDR platforms.

Analyze alert patterns, security events, and incident data to identify detection gaps and tuning opportunities.

Translate threat intelligence findings and incident response insights into actionable detection rules and use cases.

Perform regression testing for new and updated detection rules to validate functionality, accuracy, and performance.

Maintain comprehensive documentation for detection rules, including logic, data sources, expected behavior, and tuning history.

Collaborate with Tier-1 and Tier-2 SOC analysts to gather feedback and continuously improve detection effectiveness.

Map detection use cases and rules to the MITRE ATT&CK framework and applicable regulatory controls.

Support the integration and optimization of detection and incident response workflows using Cortex XSOAR, where applicable.

Support continuous improvement of detection coverage while minimizing false positives and improving alert quality.

Experience and Qualifications

5+ years of experience in SOC operations, detection engineering, or cybersecurity monitoring, with strong expertise in detection development and tuning.

Advanced experience developing SIEM queries, correlation rules, and detection logic.

Hands-on experience with SIEM/XDR platforms, alert analysis, and detection optimization.

Experience with Palo Alto Networks Cortex XSOAR, including playbook automation, incident workflows, integrations, or security orchestration, is preferred.

Proven experience in detection rule testing, validation, regression testing, and technical documentation.

Strong understanding of threat intelligence, incident response, and security event analysis.

Familiarity with MITRE ATT&CK and mapping detection capabilities to adversary tactics and techniques.

Strong analytical, troubleshooting, and collaboration skills.

Certifications Preferred

Relevant certifications in security operations, SIEM technologies, threat detection, or incident response.

Vendor-specific SIEM/XDR certifications.

• Palo Alto Networks Cortex XSOAR-related training or certifications are an advantage.