SOC Analyst - L3

Jobmaze FZ LLC; Riyadh; On-site; SAR 180,000 - 260,000; Full time

Job summary

Jobmaze FZ LLC in Riyadh seeks an experienced SOC Analyst - L3 to lead advanced security investigations, incident response, threat hunting, and SIEM detection engineering. The candidate will manage complex incidents, mentor junior analysts, and drive improvements in SOC processes and maturity.

The role requires strong expertise in MITRE ATT&CK, threat intelligence, log analysis, EDR, and cloud security monitoring.

Qualifications

• 5-8 years of experience in SOC operations, security monitoring, or incident response.
• Strong hands-on experience in SIEM detection engineering, correlation rules, and alert tuning.
• Expertise in advanced threat hunting, malware analysis, and digital forensics.
• Strong understanding of MITRE ATT&CK, threat intelligence, and IOC correlation.
• Experience with EDR, firewalls, cloud security logs, and security monitoring tools.
• Proven ability to manage high-severity incidents and conduct RCA and post-incident reviews.
• Experience in Purple Team exercises and SOC process improvement.
• Strong analytical, troubleshooting, and leadership skills.

Responsibilities

• Act as the technical escalation point for complex and high-severity security incidents.
• Lead end-to-end incident response, including investigation, containment, eradication, and recovery.
• Conduct advanced threat hunting across endpoints, networks, cloud environments, and security logs.
• Perform malware analysis, memory forensics, and root cause investigations.
• Design, develop, and optimize SIEM detection use cases aligned with the MITRE ATT&CK framework.
• Develop correlation rules, dashboards, and automated security workflows.
• Integrate threat intelligence, IOCs, and behavioral detection patterns into SIEM.
• Identify detection gaps, improve log visibility, and reduce false positives.
• Lead Purple Team exercises and SOC maturity improvements.

Job description

We are hiring an experienced SOC Analyst - L3 for our client in Riyadh to lead advanced security investigations, incident response, threat hunting, and SIEM detection engineering.

The ideal candidate will have strong technical expertise in SOC operations, incident handling, threat intelligence, and security monitoring, with the ability to manage complex incidents and mentor junior analysts.

Key Responsibilities:

• Act as the technical escalation point for complex and high-severity security incidents.
• Lead end-to-end incident response, including investigation, containment, eradication, and recovery.
• Conduct advanced threat hunting across endpoints, networks, cloud environments, and security logs.
• Perform malware analysis, memory forensics, and root cause investigations.
• Design, develop, and optimize SIEM detection use cases aligned with the MITRE ATT&CK framework.
• Develop correlation rules, dashboards, and automated security workflows.
• Integrate threat intelligence, IOCs, and behavioral detection patterns into SIEM.
• Identify detection gaps, improve log visibility, and reduce false positives.
• Lead Purple Team exercises and SOC maturity improvements.

  Key Requirements:

  • 5-8 years of experience in SOC operations, security monitoring, or incident response.
  • Strong hands-on experience in SIEM detection engineering, correlation rules, and alert tuning.
  • Expertise in advanced threat hunting, malware analysis, and digital forensics.
  • Strong understanding of MITRE ATT&CK, threat intelligence, and IOC correlation.
  • Experience with EDR, firewalls, cloud security logs, and security monitoring tools.
  • Proven ability to manage high-severity incidents and conduct RCA and post-incident reviews.
  • Experience in Purple Team exercises and SOC process improvement.
  • Strong analytical, troubleshooting, and leadership skills.