SOC L2: Incident Response & Threat Hunting Lead

Müller's Solutions; Riyadh; On-site; SAR 180,000 - 300,000; Full time

Job summary

Müller's Solutions in Riyadh, Saudi Arabia, seeks a SOC L2 Specialist to deliver managed security operations. You will handle escalated alerts from L1, lead incident response, and supervise day-to-day SOC activity.

The role requires 4–6 years in a SOC, strong SIEM hands-on experience, and proficiency in Arabic and English. You will work in an enterprise/MSSP environment and participate in on-call rotations.

Qualifications

• Bachelor's degree in Cybersecurity, CS, IT or related field.
• 4–6 years in a SOC with at least 2 years at L2 level.
• Strong hands-on SIEM experience (Splunk, QRadar, Sentinel, etc.).
• Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR.
• Knowledge of MITRE ATT&CK, kill chain, malware basics and network protocols.
• Experience in enterprise or MSSP environment.
• Saudi national; fluent in Arabic and English.
• Willing to support on-call or shift rotation.

Responsibilities

• Investigate and triage alerts escalated from L1 analysts.
• Lead incident response: containment, eradication, recovery and root cause analysis.
• Analyze logs, network traffic, endpoint telemetry and email threats.
• Tune SIEM correlation rules and use cases to reduce false positives.
• Run threat hunting based on threat intelligence and MITRE ATT&CK.
• Create and maintain incident response playbooks and SOAR workflows.
• Supervise and mentor L1 analysts, review their work, and manage shift handovers.
• Write incident reports and present findings to technical and management stakeholders.
• Report incidents in line with NCA requirements and SMC's escalation matrix.
• Track SOC KPIs such as MTTD, MTTR and SLA compliance.

Skills

Arabic and English fluency

Mentoring L1 analysts

Education

Bachelor's degree in Cybersecurity, Computer Science, IT or related field

Tools

Splunk

IBM QRadar

Microsoft Sentinel

CrowdStrike

Defender for Endpoint

SentinelOne

SOAR platforms

Job description

Müller's Solutions in Riyadh, Saudi Arabia, seeks a SOC L2 Specialist to deliver managed security operations. You will handle escalated alerts from L1, lead incident response, and supervise day-to-day SOC activity.

The role requires 4–6 years in a SOC, strong SIEM hands-on experience, and proficiency in Arabic and English. You will work in an enterprise/MSSP environment and participate in on-call rotations.