Senior Engineer, Information Security (SOC)

Department: InfoSec Monitoring

Employment Type: Full Time

Location: Riyadh, Saudi Arabia, KSA

Key Responsibilities:

• Own and improve the architecture, performance, and reliability of our Elastic SIEM environment.
• Design and maintain log ingestion pipelines, integrations, parsers, and data retention strategies.
• Expand log source coverage, improve data quality, and troubleshoot complex platform issues.
• Establish standards for log onboarding and regularly assess SIEM health, visibility, and resilience.

• Develop, maintain, and improve detection use cases aligned with the MITRE ATT&CK framework.
• Build custom detections for fintech-specific threats, including account takeover, payment fraud, and API abuse.
• Review and validate detection logic, identify false positives and coverage gaps, and improve detection quality.
• Conduct threat modelling and detection gap analysis to identify potential attack paths and strengthen monitoring coverage.
  
  

• Drive threat intelligence operations using Cyble or equivalent platforms.
• Analyse threat actors, campaigns, indicators of compromise (IOCs), and emerging threats relevant to Tabby.
• Ensure actionable intelligence is validated, enriched, and integrated into Elastic SIEM.
• Oversee brand protection activities, including prioritising findings and coordinating takedown cases.
• Support threat intelligence sharing with relevant stakeholders and regulatory bodies.
  
  

• Review high-severity incidents, validate escalations, and support effective incident resolution.
• Lead post-incident reviews and ensure root causes, remediation steps, and corrective actions are documented and tracked.
• Monitor the performance of our managed SOC provider, including service levels, detection quality, and reporting.
• Maintain incident records and security evidence aligned with applicable regulatory and audit requirements, including SAMA CSF and NCA ECC.
  
  

• Act as a senior technical escalation point for complex SIEM, detection, and CTI challenges.
• Mentor junior SOC analysts and engineers, sharing knowledge and helping them develop their technical skills.
• Maintain clear technical documentation, runbooks, and playbooks.
• Drive continuous improvement across security operations, tooling, and processes.

What you’ll bring:

• 4–5 years of progressive experience in SOC operations, SIEM engineering, detection engineering, or cyber threat intelligence.
• Strong hands-on experience with Elastic Stack, including SIEM administration, architecture, ingestion pipelines, and performance optimisation.
• Proven ability to develop complex detection rules, correlation logic, and behavioural detections.
• Experience with MITRE ATT&CK and detection coverage analysis.
• Practical experience with threat intelligence platforms such as Cyble, or equivalent tools.
• Strong understanding of incident investigation, incident management, and root cause analysis.
• Experience integrating logs from different sources, including cloud environments such as AWS and GCP.
• Scripting and automation skills, preferably with Python.
• Understanding of fintech-related threats, including account takeover, payment fraud, API abuse, and mobile application threats.
• Familiarity with security and regulatory frameworks such as SAMA CSF, NCA ECC, PDPL, and PCI DSS.
• Strong analytical, communication, documentation, and problem-solving skills.
• Ability to work independently, take ownership of complex technical challenges, and support the development of less experienced colleagues.
  
  

Benefits:

• Work on security challenges within a fast-growing fintech environment.
• Take ownership of security tooling and detection capabilities that protect real financial products and customer data.
• Make a direct impact on the maturity of our SOC and threat intelligence function.
• Collaborate with experienced security professionals and cross-functional engineering teams.