Senior Security Operations Engineer

This is a fully remote position, open to applicants in Iraq, +2 more countries.

📋 Description

• Design and manage security operations encompassing cloud, identity, endpoint, and SaaS environments.

• Develop capabilities for threat detection, threat hunting, and incident response.

• Create and construct pipelines that channel logs from cloud, identity, endpoint, and SaaS sources into the SIEM or security data lake.

• Normalize and enhance data upon ingestion.

• Oversee the health of pipelines and swiftly identify any broken log sources.

• Balance the trade-off between security coverage and cost along with retention requirements.

• Choose, implement, configure, and optimize SIEM, EDR, cloud threat detection, and automation tools.

• Set up tools to generate alerts with a high signal-to-noise ratio.

• Develop detections as code and align them with the MITRE ATT&CK framework.

• Assess and test detection coverage, prioritizing efforts based on risk.

• Take ownership of the incident response plan and corresponding playbooks.

• Serve as the incident commander during security events.

• Coordinate containment and recovery efforts with engineering, legal, and leadership teams.

• Conduct blameless post-incident reviews that enhance the organization.

• Collaborate closely with engineering and Product Security to safeguard the cloud-native platform.

• Establish and shape security operations from foundational principles as the inaugural Security Operations hire.

⛳️ Requirements

• Generally, 5+ years of experience in security operations, detection engineering, or incident response, with practical experience in building solutions.

• Prior experience in a startup or scale-up environment is highly advantageous.

• Practical experience in building detections and investigating incidents within AWS, utilizing CloudTrail, GuardDuty, VPC Flow Logs, and Kubernetes audit logs.

• Leadership experience in detection engineering and detection-as-code, incident response, cloud forensics, SIEM and security data pipeline architecture, security automation (SOAR), alert triage workflows, or threat hunting and threat intelligence.

• Proficiency in coding with Python, SQL, or the query language of the SIEM.

• Capability to treat detections and runbooks as software and to automate repetitive tasks.

• Competence in managing incidents and keeping stakeholders informed under pressure.

• Skill in communicating technical findings as impact statements along with next steps for engineers, leadership, non-technical colleagues, and customers when necessary.

• Experience in developing incident response and logging controls for SOC 2, ISO 27001, or PCI audits is a plus.

• Familiarity with managing an MDR or MSSP partner is an advantage.

• Understanding of breach notification obligations, such as UAE PDPL and customer contractual SLAs, is a plus.

• Experience in hiring or mentoring security analysts or engineers as the function expands is a plus.

🏝️ Benefits

• Immediate opportunity for significant impact within a rapidly growing business.

• Competitive compensation packages that are among the best in the market.

• Collaborate with top regional talent, including team members from Talabat, Careem, Etisalat, and more.