Senior Network & Email Security Engineer (5+ years) — Saudi National

CBT; Riyadh; On-site; SAR 167,400 - 223,200; Full time

Job summary

A cybersecurity firm is seeking a Senior Network & Email Security Engineer with over 5 years of experience in network and email security operations. The role includes hands-on management of NGFWs, incident response leadership, and compliance document preparation. The candidate must be a Saudi National and possess a strong background in incident and change management. This position is on-site in Riyadh and requires regular availability for on-call duties.

Qualifications

• 5+ years in enterprise network and email security operations.
• Hands-on with NGFWs (preferably Palo Alto) and Secure Email Gateways.
• Strong discipline in change and incident management.

Responsibilities

• Conduct daily health checks for NGFW clusters.
• Manage inbound/outbound email security policies.
• Lead P1 incident response across perimeter and email.
• Update compliance logs and audit evidence.

Skills

Network security operations

Email security operations

Incident management

Change management

Packet analysis

Tools

Palo Alto NGFW

Proofpoint

Job description

Overview

Senior Network & Email Security Engineer (5+ years) — Saudi National

Responsibilities

1. Operational Ownership (Network)

   • Daily health checks for NGFW clusters, threat/content updates, license/status, HA sync/state.

   • Rulebase hygiene: reduce unused/overlapping rules, enforce least privilege, maintain application-based policies, validate security profiles (AV/IPS/URL filtering).

   • Remote access posture (e.g., GlobalProtect or equivalent): portal/gateway policies, MFA integration with IAM team, and user experience SLAs.

   • Traffic troubleshooting: ACC/log analysis, PCAPs, policy simulation; coordinate fixes with platform owners.

2. Operational Ownership (Email Security)

   • Inbound/outbound policy tuning; phishing/BEC controls and executive spoof protection.

   • URL and attachment sandboxing effectiveness; manage quarantine queues and approval flows.

   • Partner with Messaging team on SPF/DKIM/DMARC alignment; monitor sending reputation and delivery health.

   • Provide user-facing guidance (digests, safe release, false positive/negative handling).

3. Incident Response & Threat Handling

   • Lead P1 incidents across perimeter/email; coordinate with SOC (SIEM alerts, playbooks).

   • Rapid containment (block rules, URL detonation verdicts, sender throttling), evidence capture, and RCA with corrective actions.

   • Prepare CAB-ready change plans (impact, test, rollback) for signature/content updates, firmware upgrades, and policy changes.

   • Post-change validation and documentation.

4. Compliance & Evidence

   • Update logs, quarantine reports, incident timelines, and monthly posture reviews.

   • Familiarity with SAMA & NCA CSF audit and regulations requirements.

   • Support internal/external audits with traceable evidence.

5. Documentation & KT

   • Own runbooks/SOPs (policy hygiene, incident triage, quarantine workflows, upgrade steps).

Qualifications

• Saudi National; 5+ years in enterprise network and email security operations.

• Hands-on with NGFWs (preferably Palo Alto) and a major Secure Email Gateway (e.g., Proofpoint).

• Strong change/incident management discipline; clear written reports in English (Arabic a plus).

• Comfortable with packet analysis, SSL decryption concepts, and mail flow basics with messaging teams.

Preferred

• Banking/regulated-sector experience.

• Experience integrating controls with SIEM/SOAR.

Performance Metrics

• NGFW: rulebase cleanup achieved; 100% Internet-bound policies; HA stability with zero unscheduled failovers.

• VPN: user connectivity SLA met; MFA posture validated; incident MTTR ≤ agreed SLA.

• Email: measurable drop in false negatives for phishing/BEC; quarantine SLA adherence; monthly evidence packs accepted in internal pre-audit.

Location & Model

On-site at Client’s Premises (Riyadh), Sun–Thu; on-call for P1s/changes.