SOC Analyst – Splunk & SOAR (Dubai)

About the role

We are looking for an experienced SOC Analyst to join our security operations team in Dubai. The role focuses on advanced threat detection, incident investigation, and response using Splunk and SOAR platforms. You will act as an escalation point for Level‑1 analysts and help automate security workflows.

Key responsibilities

• Monitor security alerts from Splunk SIEM and perform deep‑dive analysis of escalated incidents.
• Correlate logs from firewalls, endpoints, proxies, email, IDS/IPS and other sources.
• Investigate and respond to malware, phishing, insider threats and other incidents, including containment, eradication and recovery.
• Develop, modify and optimise SOAR playbooks (e.g., Fortinet SOAR) and automate repetitive tasks.
• Analyse threat intelligence feeds, conduct proactive threat hunting and stay current with MITRE ATT&CK techniques.
• Create incident reports, dashboards and recommendations to improve detection and response.
• Collaborate with L1 analysts, IT, network and security teams and support compliance audits.

Required profile

• Bachelor’s degree in Cybersecurity, IT or Computer Science (or equivalent).
• 3–5 years of experience in a SOC or cybersecurity operations environment.
• Strong analytical, problem‑solving and communication skills.
• Ability to work in a 24/7 shift schedule.

Required skills

• Splunk SIEM (Power User / Admin).
• SOAR platforms (e.g., Fortinet SOAR).
• Network security fundamentals (TCP/IP, DNS, HTTP/S).
• Operating systems: Windows, Linux.
• Log analysis and correlation.
• EDR tools (Symantec) and NDR tools (Vectra AI).
• Firewalls, IDS/IPS and proxy solutions (Bluecoat, Palo Alto, Cisco).
• Threat intelligence handling and MITRE ATT&CK knowledge.
• Scripting languages: Python, PowerShell.
• Cloud security basics (AWS, Azure).