Our client, a prolific global software company, is seeking a qualified SOC Analyst L3 for a full-time, onsite position in Riyadh, Saudi Arabia.
About the role
In this senior role, you will serve as the primary technical escalation point for complex, high-severity security incidents. You will lead end-to-end incident response, drive advanced threat hunting, conduct deep forensics, and design robust SIEM detection engineering workflows aligned with industry frameworks.
What you'll do
- Act as the technical escalation point for complex or high-severity incidents.
- Lead end-to-end incident response: investigation, containment, eradication, recovery.
- Conduct advanced threat hunting across endpoints, network, cloud, email, and logs.
- Perform malware analysis, memory forensics, and deep log analysis.
- Manage Purple Team exercises and drive SOC maturity improvements.
- Handle threat intelligence enrichment, IOC correlation, and intel reporting.
- Coordinate with IT, GRC, and senior management during major incidents.
- Provide advanced training and mentorship for L1 and L2 analysts.
- Lead RCA (Root Cause Analysis) and Post-Incident Review (PIR) processes.
- Evaluate and recommend new SOC technologies, tools, and integrations.
- Design, build, and maintain SIEM detection use-cases aligned with MITRE ATT&CK.
- Enhance and tune existing detection rules to improve accuracy and reduce false positives.
- Assess detection gaps and ensure proper visibility across all critical log sources.
- Validate onboarding of new log sources and ensure logs are normalised and parsed correctly.
- Work with threat intelligence to integrate new IOCs, behavioural patterns, and detection logic.
- Create detection roadmaps and continuously improve SIEM coverage.
- Develop correlation rules, dashboards, and automated workflows.
- Collaborate with infrastructure teams to ensure required logs (EDR, firewall, cloud, proxy, email, apps) are feeding into the SIEM.
- Conduct periodic tuning sessions to improve alert fidelity and SOC efficiency.
What you'll bring
- 5 to 8 years of relevant security operations experience.
- Expertise leading incident response, threat hunting, and root cause analysis.
- Hands-on ability in malware analysis, memory forensics, and log analysis.
- Demonstrated experience building and tuning SIEM detection rules mapped to MITRE ATT&CK.
- Proven ability to mentor L1 and L2 analysts and communicate effectively with IT, GRC, and executive teams.
Pay and details
- Employment type: Full-time
- Work setup: Onsite in Riyadh, Saudi Arabia
- Salary: 15,000 to 20,000 SAR per year
