Lead Security Engineer

DXC Technology Company; Saudi Arabia; On-site; SAR 300,000 - 420,000; Full time

Job summary

DXC Technology is seeking an experienced L3 Data & Endpoint Security Engineer in Saudi Arabia to own end-to-end design, hardening, and incident response across data and endpoint security controls. You will lead architecture reviews and mentor engineers while coordinating with auditors and regulators.

The role requires deep technical expertise and strong collaboration with senior leadership to meet SAMA CSF domains and business requirements.

Qualifications

• Bachelor's degree in cybersecurity, IT, or a related field.
• 7+ years of experience in data security or endpoint protection.
• Hands-on involvement with enterprise-grade DLP rollout and EDR containment.
• Strong scripting/automation skills (Python/PowerShell/REST).
• Experience presenting to auditors and senior leadership.

Responsibilities

• Design highly available DLP/DAM clusters, encryption key hierarchies, and EDR telemetry pipelines.
• Integrate all security platforms with SIEM (QRadar) and SOAR for automated response.
• Lead P1/P2 incidents including data-loss breach, ransomware and insider misuse.
• Perform deep packet and forensic analysis, and issue root-cause analyses with preventive actions.
• Build and fine-tune DLP policies and detections to meet SLAs.
• Maintain classification and retention schemes per regulatory guidance.
• Map control operation to SAMA/NCA evidence and prepare audit artefacts.
• Conduct quarterly tool health reviews and drive remediation programs.
• Create run-books, tabletop exercises and coach L2 engineers.
• Recommend budget and roadmap items including licensing, hardware and SaaS migration.

Skills

Python

PowerShell

REST API

Automation

Education

Bachelor's degree in Cybersecurity/IT

Tools

QRadar

SOAR

ForcePoint DLP

Seclore

Cortex

Job description

L3 Data & Endpoint Security Engineer – Advanced Support & Architecture

About DXC

DXC helps global companies run their mission-critical systems and operations while modernizing IT, optimizing data architectures and ensuring security and scalability across public, private and hybrid clouds. The world's largest companies and public sector organizations trust DXC to deploy services to drive new levels of performance, competitiveness, and customer experience across their IT estates. Our more than 125,000 people in 70-plus countries are entrusted by our customers to deliver transformative technologies to ensure the success, safety and well-being of businesses and people around the world. By combining strengths and expertise globally, we create solutions and deliver greater outcomes for customers across their entire IT estate. Learn more about how we deliver excellence for our customers and colleagues at dxc.com.

About the Role

The L3 Data & Endpoint Security Engineer owns the end-to-end design, hardening and incident response of every SAMA-mandated Data- and Endpoint-Security control across a broad technology stack spanning data protection, endpoint defense, threat and vulnerability management, and visibility/analytics platforms. This role serves as the final escalation point for complex security incidents, leads architecture reviews, and ensures evidence alignment with SAMA CSF domains PRV-03 (Data Security) and DE-02 (Endpoint Protection).

In this position, you will design highly available clusters and pipelines, lead root-cause analysis for critical incidents, fine-tune policies across multiple platforms, and maintain compliance with regulatory frameworks. You will also play a key leadership role, mentoring L2 engineers, building run-books and simulations, and contributing to budget and roadmap planning for the security toolset.

This is a high-visibility role requiring deep technical expertise and the ability to interface directly with auditors, regulators and senior leadership, ensuring the organization's data and endpoint security posture meets stringent regulatory and business requirements.

Essential Job Functions

• Design highly-available DLP/DAM clusters, encryption key hierarchies and EDR telemetry pipelines
• Integrate all security platforms with SIEM (QRadar) and SOAR for automated response
• Lead P1/P2 incidents including data-loss breach, ransomware and insider misuse across the full tool set
• Perform deep packet and forensic analysis, and issue formal root-cause analysis reports with preventive actions
• Build and fine-tune ForcePoint DLP policies, Seclore rights templates, and Cortex detections to meet business and regulator SLAs
• Maintain classification and retention schemes per SAMA SecReg
• Map control operation to SAMA / NCA ECC evidence, prepare audit artefacts and lead regulator walkthroughs
• Conduct quarterly tool health and efficacy reviews, and drive remediation programmes
• Create run-books, tabletop exercises and lab simulations, and coach three L2 engineers
• Recommend budget and roadmap items including licensing, hardware and SaaS migration

Basic Qualifications

• Bachelors in Cybersecurity, IT or related field
• 7+ years specialized in data-security or endpoint-protection, with hands‑on experience in ≥70% of the listed tool stack
• Past ownership of enterprise-grade DLP rollout and EDR containment playbooks
• Strong ing/automation skills (Python/PowerShell/REST)
• Proven experience presenting to auditors and senior leadership

Other Qualifications

• CISSP, CISM, or GIAC (GCFA/GCED)
• Vendor certifications: ForcePoint DSSP, Imperva DSF, Trend Micro CPSE/XDR, Carbon Black PCED, Thales Certified Engineer, Tripwire TIPS
• ITIL v4, ISO 27001 Lead Auditor