SOC L2 InfoSec Engineer — Threat Detection & Response

تابي; Saudi Arabia; On-site; SAR 180,000 - 240,000; Full time

Job summary

Tabby in Saudi Arabia is seeking an Information Security Engineer (SOC L2) to monitor and defend our infrastructure, applications, and cloud environments from cyber threats. You’ll lead incident response, tune detection rules, and collaborate with cross-functional teams to strengthen security posture.

The role requires 2–3 years in a SOC or cybersecurity operations role, strong incident handling skills, and experience with SIEM, EDR/XDR, and threat intelligence platforms.

Qualifications

• 2–3 years of experience in a SOC or cybersecurity operations role.
• Strong knowledge of incident handling, alert triage, and log analysis.
• Familiarity with cloud environments and cloud-native logging.
• Experience with phishing detection, user behavior analytics, and security awareness.

Responsibilities

• Monitor and analyze logs and alerts from firewalls, IDS/IPS, endpoints, and cloud platforms.
• Lead incident response from detection through recovery and post-mortems.
• Develop and tune detection rules and CTI-driven detections.
• Collaborate with IT, DevOps, Risk, and Compliance during incidents.
• Mentor junior analysts in the SOC.

Skills

SOC operations

Incident response

Log analysis

Threat hunting

Python scripting

Tools

SIEM platforms

SOAR tools

EDR/XDR

Threat Intelligence platforms

Job description

Tabby in Saudi Arabia is seeking an Information Security Engineer (SOC L2) to monitor and defend our infrastructure, applications, and cloud environments from cyber threats. You’ll lead incident response, tune detection rules, and collaborate with cross-functional teams to strengthen security posture.

The role requires 2–3 years in a SOC or cybersecurity operations role, strong incident handling skills, and experience with SIEM, EDR/XDR, and threat intelligence platforms.