Senior Engineer, Information Security (SOC)

Tabby; Saudi Arabia; On-site; SAR 240,000 - 340,000; Full time

Benefits offered by this job

Fintech-focused environment

Career growth in security engineering

Regulatory compliance exposure

Job summary

Tabby is seeking a Senior Engineer, Information Security (SOC) to own and advance our Elastic SIEM platform, drive detection engineering, and operationalize threat intelligence in a fintech regulatory context. You will mentor juniors, collaborate with internal and external partners, and act as a technical escalation point for complex SOC challenges.

In this hands-on role, you’ll strengthen incident response, improve data quality and coverage, and ensure security controls align with SAMA CSF and

Qualifications

• 4-5 years of progressive experience in SOC operations, SIEM engineering, detection engineering, or cyber threat intelligence.
• Strong hands-on experience with Elastic Stack, including SIEM administration, architecture, ingestion pipelines, and performance optimisation.
• Proven ability to develop complex detection rules, correlation logic, and behavioural detections.
• Experience with MITRE ATT&CK and detection coverage analysis.
• Practical experience with threat intelligence platforms such as Cyble, or equivalent tools.
• Strong understanding of incident investigation, incident management, and root cause analysis.
• Experience integrating logs from different sources, including cloud environments such as AWS and GCP.
• Scripting and automation skills, preferably with Python.
• Understanding of fintech-related threats, including account takeover, payment fraud, API abuse, and mobile application threats.
• Familiarity with security and regulatory frameworks such as SAMA CSF, NCA ECC, PDPL, and PCI DSS.
• Strong analytical, communication, documentation, and problem-solving skills.

Responsibilities

• SIEM Engineering & Platform Ownership: Own Elastic SIEM architecture, performance, and reliability; design log ingestion pipelines and data retention strategies.
• Detection Engineering: Develop and improve detection use cases aligned with MITRE ATT&CK; build detections for fintech threats.
• Cyber Threat Intelligence: Drive CTI operations, analyse IOCs and campaigns, validate intelligence for Elastic SIEM.
• SOC Governance & Incident Management: Review high-severity incidents, lead post-incident reviews, oversee provider performance.
• Technical Leadership & Mentorship: Mentor juniors, maintain runbooks, drive continuous improvement across security operations.

Skills

SOC operations

SIEM engineering

Detection engineering

Cyber threat intelligence

MITRE ATT&CK

Threat modelling

Incident investigation

Python scripting

Log analysis

Analytical thinking

Tools

Elastic Stack

Cyble

AWS

GCP

Job description

Senior Engineer, Information Security (SOC)

Department: InfoSec Monitoring

Employment Type: Full Time

Location: KSA

Reporting To: Aseel Alghuraybi

Description

We're looking for a Senior Engineer, Information Security (SOC) to take technical ownership of our Security Operations Center capabilities, with a particular focus on SIEM engineering, detection development, and threat intelligence.

This is a hands-on senior individual contributor role for someone who can go beyond monitoring alerts and improve how security threats are detected, investigated, and managed. You'll own and continuously improve our Elastic SIEM platform, develop advanced detection use cases, operationalize threat intelligence, and ensure the quality of incident response and our managed SOC provider's performance.

You'll also act as a key technical escalation point, mentor junior team members, and work closely with internal stakeholders and external partners to strengthen Tabby's security capabilities in a regulated fintech environment.

Key Responsibilities:

SIEM Engineering & Platform Ownership

• Own and improve the architecture, performance, and reliability of our Elastic SIEM environment.
• Design and maintain log ingestion pipelines, integrations, parsers, and data retention strategies.
• Expand log source coverage, improve data quality, and troubleshoot complex platform issues.
• Establish standards for log onboarding and regularly assess SIEM health, visibility, and resilience.

Detection Engineering

• Develop, maintain, and improve detection use cases aligned with the MITRE ATT&CK framework.
• Build custom detections for fintech-specific threats, including account takeover, payment fraud, and API abuse.
• Review and validate detection logic, identify false positives and coverage gaps, and improve detection quality.
• Conduct threat modelling and detection gap analysis to identify potential attack paths and strengthen monitoring coverage.

Cyber Threat Intelligence (CTI)

• Drive threat intelligence operations using Cyble or equivalent platforms.
• Analyse threat actors, campaigns, indicators of compromise (IOCs), and emerging threats relevant to Tabby.
• Ensure actionable intelligence is validated, enriched, and integrated into Elastic SIEM.
• Oversee brand protection activities, including prioritising findings and coordinating takedown cases.
• Support threat intelligence sharing with relevant stakeholders and regulatory bodies.

SOC Governance & Incident Management

• Review high-severity incidents, validate escalations, and support effective incident resolution.
• Lead post-incident reviews and ensure root causes, remediation steps, and corrective actions are documented and tracked.
• Monitor the performance of our managed SOC provider, including service levels, detection quality, and reporting.
• Maintain incident records and security evidence aligned with applicable regulatory and audit requirements, including SAMA CSF and NCA ECC.

Technical Leadership & Mentorship

• Act as a senior technical escalation point for complex SIEM, detection, and CTI challenges.
• Mentor junior SOC analysts and engineers, sharing knowledge and helping them develop their technical skills.
• Maintain clear technical documentation, runbooks, and playbooks.
• Drive continuous improvement across security operations, tooling, and processes.

What you'll bring:

• 4-5 years of progressive experience in SOC operations, SIEM engineering, detection engineering, or cyber threat intelligence.
• Strong hands-on experience with Elastic Stack, including SIEM administration, architecture, ingestion pipelines, and performance optimisation.
• Proven ability to develop complex detection rules, correlation logic, and behavioural detections.
• Experience with MITRE ATT&CK and detection coverage analysis.
• Practical experience with threat intelligence platforms such as Cyble, or equivalent tools.
• Strong understanding of incident investigation, incident management, and root cause analysis.
• Experience integrating logs from different sources, including cloud environments such as AWS and GCP.
• Scripting and automation skills, preferably with Python.
• Understanding of fintech-related threats, including account takeover, payment fraud, API abuse, and mobile application threats.
• Familiarity with security and regulatory frameworks such as SAMA CSF, NCA ECC, PDPL, and PCI DSS.
• Strong analytical, communication, documentation, and problem-solving skills.
• Ability to work independently, take ownership of complex technical challenges, and support the development of less experienced colleagues.

Certifications: Relevant Elastic and GIAC certifications are required for this role under the internal job specification. CTI certifications are also expected; CISSP, CISM, or equivalent senior security certifications are an advantage.

Benefits:

• Work on security challenges within a fast-growing fintech environment.
• Take ownership of security tooling and detection capabilities that protect real financial products and customer data.
• Make a direct impact on the maturity of our SOC and threat intelligence function.
• Collaborate with experienced security professionals and cross-functional engineering teams.