Senior Security Operations Engineer

This is a fully remote position, open to applicants in Iraq, +2 more countries.

📋 Description

• Design and manage security operations across cloud environments, identity, endpoints, and Software as a Service (SaaS).

• Develop capabilities for threat detection, proactive threat hunting, and incident response.

• Create and implement data pipelines that aggregate logs from cloud services, identity systems, endpoints, and SaaS sources into the Security Information and Event Management (SIEM) or security data lake.

• Normalize and enhance data during the ingestion process.

• Monitor the health of data pipelines and promptly identify broken log sources.

• Balance security measures with cost and data retention requirements.

• Select, deploy, configure, and fine-tune SIEM, Endpoint Detection and Response (EDR), cloud threat detection, and automation tools.

• Set up tools to generate alerts with a favorable signal-to-noise ratio.

• Create detection rules as code and align them with the MITRE ATT&CK framework.

• Assess and test detection coverage, prioritizing efforts based on risk assessment.

• Take ownership of the incident response plan and associated playbooks.

• Serve as the incident commander during security events.

• Facilitate containment and recovery efforts in collaboration with engineering, legal, and leadership teams.

• Conduct blameless post-incident reviews to fortify the organization.

• Collaborate closely with engineering and Product Security to safeguard the cloud-native platform.

• Establish and develop security operations from the ground up as the inaugural Security Operations hire.

⛳️ Requirements

• Typically possess 5+ years of experience in security operations, detection engineering, or incident response, with practical hands-on experience in building solutions.

• A background in startups or scale-ups is highly advantageous.

• Demonstrated hands-on experience in creating detections and investigating incidents within AWS, utilizing services such as CloudTrail, GuardDuty, VPC Flow Logs, and Kubernetes audit logs.

• Leadership experience in detection engineering and detection-as-code, incident response, cloud forensics, SIEM and security data pipeline architecture, security automation (SOAR), alert triage workflows, or threat hunting and intelligence.

• Proficiency in coding with Python, SQL, or the query language specific to the SIEM.

• Capability to treat detections and runbooks as software and automate repetitive tasks.

• Ability to manage incidents and keep stakeholders updated under pressure.

• Skill in communicating technical findings as impactful statements and outlining next steps for engineers, leadership, non-technical colleagues, and customers when necessary.

• Experience in establishing incident response and logging controls for SOC 2, ISO 27001, or PCI audits is desirable.

• Experience in managing a Managed Detection and Response (MDR) or Managed Security Service Provider (MSSP) partner is beneficial.

• Familiarity with breach notification requirements, such as UAE PDPL and customer contractual Service Level Agreements (SLAs), is a bonus.

• Experience in hiring or mentoring security analysts or engineers as the team expands is a plus.

🏝️ Benefits

• Immediate opportunity to make a significant impact on a rapidly growing business.

• Competitive compensation packages that are among the best in the market.

• Collaborate with top regional talent, including team members from Talabat, Careem, Etisalat, and more.