Lead Security Engineer

DXC Technology; Riyadh; On-site; SAR 420,000 - 540,000; Full time

Job summary

DXC Technology Company in Riyadh seeks an L3 Data & Endpoint Security Engineer to own end-to-end design, hardening, and incident response for data and endpoint security controls across a broad tech stack. You will collaborate with auditors and senior leadership to ensure regulatory alignment.

You will design highly available clusters, lead root-cause analyses for critical incidents, and mentor L2 engineers while shaping security roadmaps and budgets for the toolset.

Qualifications

• Bachelor’s degree in cybersecurity, IT, or related field.
• 7+ years in data security or endpoint protection with hands-on tool experience.
• Proven track record deploying enterprise DLP and EDR containment playbooks.
• Experience presenting to auditors and senior leadership.

Responsibilities

• Design highly available DLP/DAM clusters and encryption key hierarchies.
• Integrate security platforms with SIEM (QRadar) and SOAR.
• Lead P1/P2 incidents including data loss breaches and ransomware.
• Perform deep packet and forensic analysis with root-cause reports.
• Develop and tune DLP policies and Cortex detections to meet SLAs.
• Maintain classification and retention schemes per SAMA SecReg.
• Map control operations to SAMA/NCA evidences and lead regulator walkthroughs.
• Conduct quarterly tool health reviews and remediation programs.
• Create run-books and coach L2 engineers.
• Recommend budget and roadmap items for licensing, hardware and SaaS migration.

Skills

Data security

Endpoint protection

Incident response

Auditor communication

Education

Bachelor's degree in Cybersecurity/IT

Tools

QRadar SIEM

SOAR platforms

ForcePoint DLP

Seclore rights

Cortex detections

EDR

Job description

L3 Data & Endpoint Security Engineer – Advanced Support & Architecture

About DXC

DXC helps global companies run their mission-critical systems and operations while modernizing IT, optimizing data architectures and ensuring security and scalability across public, private and hybrid clouds. The world’s largest companies and public sector organizations trust DXC to deploy services to drive new levels of performance, competitiveness, and customer experience across their IT estates. Our more than 125,000 people in 70-plus countries are entrusted by our customers to deliver transformative technologies to ensure the success, safety and well-being of businesses and people around the world. By combining strengths and expertise globally, we create solutions and deliver greater outcomes for customers across their entire IT estate. Learn more about how we deliver excellence for our customers and colleagues at dxc.com.

About the Role

The L3 Data & Endpoint Security Engineer owns the end-to-end design, hardening and incident response of every SAMA-mandated Data- and Endpoint-Security control across a broad technology stack spanning data protection, endpoint defense, threat and vulnerability management, and visibility/analytics platforms. This role serves as the final escalation point for complex security incidents, leads architecture reviews, and ensures evidence alignment with SAMA CSF domains PRV-03 (Data Security) and DE-02 (Endpoint Protection).

In this position, you will design highly available clusters and pipelines, lead root-cause analysis for critical incidents, fine-tune policies across multiple platforms, and maintain compliance with regulatory frameworks. You will also play a key leadership role, mentoring L2 engineers, building run-books and simulations, and contributing to budget and roadmap planning for the security toolset.

This is a high-visibility role requiring deep technical expertise and the ability to interface directly with auditors, regulators and senior leadership, ensuring the organization's data and endpoint security posture meets stringent regulatory and business requirements.

Essential Job Functions

• Design highly-available DLP/DAM clusters, encryption key hierarchies and EDR telemetry pipelines
• Integrate all security platforms with SIEM (QRadar) and SOAR for automated response
• Lead P1/P2 incidents including data-loss breach, ransomware and insider misuse across the full tool set
• Perform deep packet and forensic analysis, and issue formal root-cause analysis reports with preventive actions
• Build and fine-tune ForcePoint DLP policies, Seclore rights templates, and Cortex detections to meet business and regulator SLAs
• Maintain classification and retention schemes per SAMA SecReg
• Map control operation to SAMA / NCA ECC evidence, prepare audit artefacts and lead regulator walkthroughs
• Conduct quarterly tool health and efficacy reviews, and drive remediation programmes
• Create run-books, tabletop exercises and lab simulations, and coach three L2 engineers
• Recommend budget and roadmap items including licensing, hardware and SaaS migration

Basic Qualifications

• Bachelors in Cybersecurity, IT or related field
• 7+ years specialized in data-security or endpoint-protection, with hands-on experience in ≥70% of the listed tool stack
• Past ownership of enterprise-grade DLP rollout and EDR containment playbooks
• Proven experience presenting to auditors and senior leadership

Other Qualifications

• CISSP, CISM, or GIAC (GCFA/GCED)
• Vendor certifications: ForcePoint DSSP, Imperva DSF, Trend Micro CPSE/XDR, Carbon Black PCED, Thales Certified Engineer, Tripwire TIPS