Specialist - Information Security

About the role

Core42 is seeking an experienced Information Security Specialist to join its Dubai team. The role focuses on designing, implementing and operating Microsoft Sentinel and related security technologies in a large‑scale, multi‑cloud environment.

Key responsibilities

• Design and deploy Microsoft Sentinel architectures for enterprise, hybrid and multi‑cloud workloads, including Log Analytics workspace strategy, retention and cost optimisation.
• Onboard Microsoft and third‑party telemetry via native connectors, Syslog, CEF, APIs, Data Collection Rules and custom ingestion methods.
• Integrate Sentinel with Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, Defender for Cloud, Entra ID, CrowdStrike, Elastic and Corelight.
• Develop KQL analytics rules, correlation logic, hunting queries, workbooks, dashboards and MITRE ATT&CK‑aligned detection use cases.
• Implement SOAR automation using Sentinel automation rules, Logic Apps and playbooks for enrichment, containment, ticketing and response workflows.
• Own day‑to‑day Sentinel administration, monitoring, health management and troubleshooting of log ingestion, connector failures and query errors.
• Maintain operational dashboards, KPIs, SOPs, runbooks and documentation while supporting platform upgrades and continuous improvement.
• Conduct threat detection, incident investigation and response activities across the environment.

Required profile

• 7–8 years of hands‑on cybersecurity experience in large enterprise settings.
• Strong expertise with Microsoft Security Stack, especially Microsoft Sentinel and Defender suite.
• Proven experience with CrowdStrike, Elastic EDR, Corelight NDR, Red Hat OpenShift and OpenStack security implementations.
• Demonstrated ability to perform threat hunting, detection engineering and complex incident response.

Required skills

• Microsoft Sentinel
• Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, Defender for Cloud, Entra ID
• CrowdStrike
• Elastic EDR
• Corelight NDR
• Red Hat OpenShift
• OpenStack security
• KQL (Kusto Query Language)
• Azure Logic Apps / Playbooks
• SIEM, SOAR, API integration, Syslog, CEF