Analyst - Security Operations

About the role

Core42 is seeking a hands‑on Security Operations Analyst to join its 24×7 SOC in Abu Dhabi. You will own incidents from the first alert in Splunk through containment, eradication and recovery, while improving detection quality and mentoring junior analysts.

Key responsibilities

• Monitor and triage security alerts in Splunk, identifying genuine incidents.
• Investigate EDR and NDR alerts involving malware, credential theft, ransomware and lateral movement.
• Lead full‑lifecycle incident response: identification, containment, eradication, recovery and post‑incident review.
• Create, tune and optimise Splunk correlation searches, dashboards and SPL queries.
• Manage Cribl Stream/Edge pipelines for log routing, filtering and enrichment.
• Develop and maintain incident response playbooks and SOPs.
• Conduct hypothesis‑driven threat hunts and map detection coverage to MITRE ATT&CK.

Required profile

• Senior‑level practitioner with strong incident‑response experience.
• Ability to act as escalation point and mentor for less‑experienced analysts.
• Comfort working with virtualised and containerised infrastructure log sources.

Required skills

• Splunk (SIEM) and SPL query language.
• Cribl Stream/Edge.
• Elastic Security (EDR).
• Corelight (NDR).
• OpenStack.
• Red Hat OpenShift.
• MITRE ATT&CK framework.