SOC Analyst Level 1

About the role

SecurityHQ is hiring a SOC Analyst Level 1 for its 24/7 Security Operations Centre in Dubai. As the first line of defence, you monitor security events, investigate alerts and help protect customer environments from cyber threats, working alongside SOC Level 2 Analysts and Security Engineers. The role suits early-career cybersecurity professionals seeking hands-on experience in a fast-paced MSSP environment.

The schedule is rotating shifts (7 AM to 3 PM, 3 PM to 11 PM, 11 PM to 7 AM), including weekends and holidays, with two days off per week. You are based onsite in Dubai and assigned to one of three customer locations within about 20 km of the office.

Key responsibilities

• Monitor security alerts across SIEM, EDR, IDS/IPS, firewalls and other security platforms.
• Perform initial triage to distinguish false positives from actionable incidents.
• Analyse logs, events and indicators of compromise (IOCs).
• Follow SOC runbooks and SOPs for alert handling and escalation.
• Create and update incident tickets with accurate details and timelines.
• Escalate suspicious activity or confirmed incidents to SOC Level 2 Analysts.
• Conduct basic threat intelligence lookups (IP, URL, hash reputation).
• Support shift handovers and achieve SOC KPIs such as TTT, TTQ and SLA adherence.

Required profile

• Basic understanding of cybersecurity concepts such as malware, phishing, DDoS and brute-force attacks.
• Bachelor's degree in Information Technology, Computer Science, Cybersecurity or equivalent practical experience.
• Experience in a SOC, MSSP or IT security operations environment.
• Ability to follow procedures and work in a 24/7 environment.
• Certifications such as Security+, CEH (Foundation) or SC-200 are beneficial.

Required skills

• Working knowledge of Windows and Linux.
• Familiarity with networking basics (TCP/IP, DNS, HTTP/S) and troubleshooting.
• Exposure to SIEM tools such as Microsoft Sentinel, QRadar or Splunk.
• Understanding of EDR tools such as Microsoft Defender, Trend Micro or SentinelOne.