Security Operations Center Analyst

NourNet; Riyadh; On-site; SAR 120,000 - 180,000; Full time

Job summary

NourNet is seeking a CDC L1 SOC Analyst to join our Cyber Defense Center. You will monitor security events in real-time, perform triage, and coordinate initial responses to potential incidents.

The role requires engagement with SIEM platforms, escalation procedures, and thorough documentation. A 24x7 shift environment and a passion for threat detection are essential.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Security or related field.
• Hands-on exposure to SIEM platforms (XSIAM, Splunk, QRadar).
• Basic experience in incident handling, phishing triage, and IOC enrichment.
• Understanding of SOC operations and shift-based monitoring.
• Strong analytical and problem-solving skills.
• Excellent attention to detail and documentation discipline.
• Ability to work effectively in a 24×7 shift environment.

Responsibilities

• Monitor security alerts across SIEM, XDR, EDR, Firewall, IDS/IPS, WAF, Email Security.
• Perform initial alert triage, validate events, and assign severity.
• Conduct basic investigation and IOC enrichment using threat intel sources.
• Perform authorized first-response actions including endpoint isolation.
• Escalate incidents to Tier 2 / Incident Response per procedures.
• Document investigation steps, findings, and actions in the ticketing system.
• Follow SOC runbooks, playbooks, and escalation procedures.
• Maintain shift handover reports and participate in simulations and trainings.

Skills

Analytical skills

Documentation discipline

SOC operations understanding

24x7 shift adaptability

Attention to detail

Education

Bachelor’s degree in Cybersecurity, Computer Science, Information Security

Tools

XSIAM

Splunk

QRadar

ServiceNow

JIRA

Remedy

Job description

NourNet is looking for a CDC L1 SOC Analyst to join our Cyber Defense Center and serve as the first line of defense against cyber threats.

The role focuses on real-time security monitoring, alert triage, initial investigation, first-response actions, and timely escalation of potential security incidents.

Key Responsibilities

• Monitor security alerts across SIEM, XDR, EDR, Firewall, IDS/IPS, WAF, Email Security, and other security platforms.
• Perform initial alert triage, validate events, identify false positives, and assign appropriate severity.
• Conduct basic investigation and IOC enrichment using threat intelligence sources.
• Perform authorized first-response actions, including endpoint isolation, session termination, and temporary blocking.
• Escalate confirmed or suspicious incidents to Tier 2 / Incident Response teams based on established procedures.
• Document investigation steps, findings, and actions accurately in the ticketing system.
• Follow SOC runbooks, playbooks, and escalation procedures.
• Maintain accurate shift handover reports covering ongoing incidents, watch items, and operational updates.
• Participate in security simulations, training, and continuous improvement activities.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field.
• Hands-on exposure to SIEM platforms, such as XSIAM, Splunk, or QRadar.
• Basic experience in incident handling, phishing triage, and IOC enrichment.
• Understanding of SOC operations and shift-based monitoring.
• Strong analytical and problem-solving skills.
• Excellent attention to detail and documentation discipline.
• Ability to work effectively in a 24×7 shift environment.

Preferred Technologies

SIEM: XSIAM, Splunk, QRadar

Ticketing: ServiceNow, JIRA, Remedy

If you have a strong interest in cybersecurity, threat detection, and SOC operations and are looking to grow your career within a Cyber Defense Center, we’d like to hear from you.