SOC Information Security Engineer – Incident Response

تابي; Saudi Arabia; On-site; SAR 120,000 - 180,000; Full time

Job summary

Tabby is seeking an Information Security Engineer (SOC) to monitor and defend our fintech infrastructure and cloud environments. You will lead incident response, develop detection rules, and collaborate with IT, DevOps, Risk, and Compliance teams to strengthen our security posture.

You will work in a fast-paced fintech setting, prioritizing threat detection, incident containment, and proactive security improvements across on-premise and cloud assets.

Qualifications

• 3–4 years of experience in a SOC or cybersecurity operations role.
• Strong knowledge of incident handling, alert triage, log analysis, and threat modeling.
• Experience with REST APIs, microservices, and modern application architectures.
• Familiarity with phishing detection, user behavior analytics, and security awareness campaigns.
• Experience with SIEM, SOAR, EDR/XDR, and CTI platforms is preferred.

Responsibilities

• Monitor and analyze logs and alerts from firewalls, IDS/IPS, endpoints, servers, and cloud platforms.
• Correlate events from multiple sources to identify advanced threats.
• Fine-tune alert thresholds and detection logic to reduce false positives.
• Maintain dashboards and reporting for real-time security posture.
• Respond to incidents through lifecycle stages: detection, containment, eradication, recovery, lessons learned.
• Coordinate with internal stakeholders and external vendors during high-severity incidents or data breaches.
• Perform root cause analysis and forensic investigations using endpoint and network artifacts.
• Maintain incident documentation and contribute to post-mortem analysis.

Skills

SOC operations

Incident handling

Log analysis

Threat modeling

Cloud security

Python scripting

Tools

SIEM platforms

SOAR tools

EDR/XDR

Threat Intelligence platforms

Job description

Tabby is seeking an Information Security Engineer (SOC) to monitor and defend our fintech infrastructure and cloud environments. You will lead incident response, develop detection rules, and collaborate with IT, DevOps, Risk, and Compliance teams to strengthen our security posture.

You will work in a fast-paced fintech setting, prioritizing threat detection, incident containment, and proactive security improvements across on-premise and cloud assets.