L3 SOC at VaporVM

Dubai, Dubai, United Arab Emirates -

Full Time

Start Date

Immediate

Expiry Date

17 Dec, 26

Salary

420000.0

Posted On

18 Sep, 26

Experience

15 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Yes

Skills

Industry

Information Technology & Services

Description

Job Description

Roles & Responsibilities

Job Description:

L3 SOC / Splunk Engineer 1 Position Job Title: L3 SOC / Splunk Engineer Nationality: Saudi National Location: Saudi Arabia Department: Security Operations Center (SOC) Level: L3 Positions: 1 Job Summary The L3 SOC / Splunk Engineer will serve as a senior technical resource responsible for advanced threat hunting, complex incident investigation, Splunk architecture and optimization, detection engineering, and technical leadership within the SOC. The engineer will handle the most complex security incidents escalated from L1/L2 and will contribute to improving the overall SOC detection and response capabilities.

Key Responsibilities

Lead investigation of complex and high-severity security incidents.
Perform advanced threat hunting using Splunk and other security platforms.
Conduct advanced correlation and analysis of security events.
Perform root-cause analysis for sophisticated security incidents.
Develop advanced Splunk detection and correlation use cases.
Design and optimize Splunk Enterprise Security implementations.
Develop advanced SPL queries and complex correlation searches.
Design and maintain: Dashboards Reports Alerts Correlation searches Risk-based detections Security monitoring use cases
Perform advanced threat hunting based on: MITRE ATT&CK Threat intelligence IOCs TTPs Emerging threats
Identify gaps in current security monitoring and develop new detection capabilities.
Lead detection engineering and use-case development.
Perform Splunk performance and search optimization.
Support Splunk data onboarding and normalization.
Work with CIM (Common Information Model) and data models.
Support SOAR integration and security automation where applicable.
Provide technical leadership to L1 and L2 SOC engineers.
Review and validate incident investigations.
Lead major incident response activities.
Coordinate with infrastructure, network, cloud, endpoint, and application security teams.
Develop technical incident reports and recommendations.
Participate in SOC architecture and continuous improvement initiatives.
Define and improve SOC processes, playbooks, and operational procedures.
Support compliance and audit requirements.
Provide technical input for new security use cases and security technologies.

Required Technical Skills

Expert-level knowledge of Splunk Enterprise Security .
Advanced SPL development skills.
Strong experience with Splunk: Enterprise Security CIM Data Models Correlation Searches Risk-Based Alerting Dashboards Reports
Strong experience in SIEM architecture and engineering.
Advanced threat hunting experience.
Strong knowledge of: Network security Endpoint security Cloud security Identity and access management Malware analysis concepts Threat intelligence Incident response
Strong understanding of MITRE ATT&CK.
Experience with SOC automation and SOAR is preferred.
Experience integrating multiple security technologies with Splunk.
Strong troubleshooting and analytical skills.
Ability to lead complex security investigations.

Responsibilities

Job Description

Roles & Responsibilities

Job Description:

Key Responsibilities

Lead investigation of complex and high-severity security incidents.
Perform advanced threat hunting using Splunk and other security platforms.
Conduct advanced correlation and analysis of security events.
Perform root-cause analysis for sophisticated security incidents.
Develop advanced Splunk detection and correlation use cases.
Design and optimize Splunk Enterprise Security implementations.
Develop advanced SPL queries and complex correlation searches.
Design and maintain: Dashboards Reports Alerts Correlation searches Risk-based detections Security monitoring use cases
Perform advanced threat hunting based on: MITRE ATT&CK Threat intelligence IOCs TTPs Emerging threats
Identify gaps in current security monitoring and develop new detection capabilities.
Lead detection engineering and use-case development.
Perform Splunk performance and search optimization.
Support Splunk data onboarding and normalization.
Work with CIM (Common Information Model) and data models.
Support SOAR integration and security automation where applicable.
Provide technical leadership to L1 and L2 SOC engineers.
Review and validate incident investigations.
Lead major incident response activities.
Coordinate with infrastructure, network, cloud, endpoint, and application security teams.
Develop technical incident reports and recommendations.
Participate in SOC architecture and continuous improvement initiatives.
Define and improve SOC processes, playbooks, and operational procedures.
Support compliance and audit requirements.
Provide technical input for new security use cases and security technologies.

Required Technical Skills

Expert-level knowledge of Splunk Enterprise Security .
Advanced SPL development skills.
Strong experience with Splunk: Enterprise Security CIM Data Models Correlation Searches Risk-Based Alerting Dashboards Reports
Strong experience in SIEM architecture and engineering.
Advanced threat hunting experience.
Strong knowledge of: Network security Endpoint security Cloud security Identity and access management Malware analysis concepts Threat intelligence Incident response
Strong understanding of MITRE ATT&CK.
Experience with SOC automation and SOAR is preferred.
Experience integrating multiple security technologies with Splunk.
Strong troubleshooting and analytical skills.
Ability to lead complex security investigations.