SOC Analyst - Cyber Defense Centre

About the role

Abu Dhabi Commercial Bank is looking for an analyst to join its Group Business Service team at the Cyber Defense Centre. The SOC analyst monitors, analyzes and investigates real-time and historical security events, runs incident triage and forensics, coordinates response and remediation and closes cyber security incidents. The role uses SIEM, SOAR, data leakage monitoring, email security analysis and other security technologies.

Key responsibilities

• Monitor security events day to day and analyze real-time and historical data from SIEM and other platforms, identifying anomalies, policy violations and indicators of compromise.
• Validate and triage alerts, correlate events across sources and distinguish genuine incidents from false positives.
• Analyze phishing and malicious emails, including URLs, attachments and headers, and coordinate containment actions.
• Raise, classify, investigate and manage incidents according to incident management procedures, and conduct forensic analysis of scope, impact, root cause and affected assets.
• Coordinate containment, remediation and recovery with infrastructure, application, network and endpoint teams, and keep complete incident records.
• Use SIEM for event monitoring and correlation, and SOAR for incident workflows, enrichment, escalation and response.
• Liaise with internal teams, request changes after incidents and provide advice on emerging threats and attack techniques.
• Prepare daily, weekly and monthly security reports, maintain metrics and KRIs, track remediation actions and suggest improvements to detection and response.

Required profile

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology or a related discipline.
• Preferred: practical SOC, SIEM and/or SOAR experience, and experience in banking or financial services.
• Preferred: certifications such as Microsoft Security, Security+, CySA+, GCIH or GCIA.
• Ability to support shift-based or on-call SOC operations.

Required skills

• SIEM event monitoring, correlation and investigation; SOAR incident handling.
• Firewalls, IDS/IPS, endpoint security, email security, DLP, web security and network monitoring.
• Malware, phishing, botnets, vulnerabilities, indicators of compromise and incident response fundamentals.
• Basic AI skills for investigation, summarization and automation with human oversight.

What we offer

• Competitive salary and eligibility for a variable pay plan.
• Medical insurance, group life and personal accident insurance, paid leave and leave airfare.