Senior Security Operations Engineer (AI-Driven Defense)

About the role

Deriv is looking for a Senior Security Operations Engineer in Dubai to join its Security Operations team, which protects a distributed trading platform that runs 24/7. The role focuses on proactive threat detection and response, using AI and automation to make threats irrelevant before they become incidents. It covers threat detection and response, AI-driven defense, security hardening and cross-functional security integration.

Key responsibilities

• Detect and hunt: extend SIEM custom rules, AI-powered anomaly baselines and automated alert enrichment; run threat hunts using behavioural analytics, log forensics and threat intelligence; tune EDR/XDR to reduce false positives
• Automate response: build incident response playbooks and runbooks, and automated dashboards covering detection coverage, active incidents, misconfiguration trends and policy compliance
• Harden the perimeter: review cloud, endpoint, network and application configurations against MITRE ATT&CK, CIS and NIST benchmarks; enforce Zero Trust through IAM, least privilege, MFA and conditional access; protect the build pipeline with container security, CI/CD guardrails and automated compliance scanning
• Cross-functional security: integrate controls into engineering workflows, CI/CD pipelines and DevOps processes

Required profile

• 8+ years in security operations, incident response, threat detection or blue team work
• Experience writing custom SIEM detection rules and reducing false positives significantly
• Experience automating repetitive tasks with Python, Bash or Terraform
• Experience with ML-based anomaly detection, UEBA or AI-driven phishing models
• Cloud security experience on AWS, GCP or Azure
• Ability to explain technical risk to engineering leads and executives
• Certifications such as CISSP, GSEC or AWS Security Specialty are a plus but not required

Required skills

• Python, Bash, Terraform
• SIEM and custom detection rules
• EDR/XDR, UEBA, behavioural analytics
• Okta, Google Workspace, Azure AD (SSO, MFA, conditional access)
• AWS, GCP, Azure security posture management and compliance scanning
• WAF/CDN hardening, API abuse prevention, bot mitigation