Confidential Company

Job Description

Saudi Arabia Employment Type: Full-Time Operational Model: 24/7 SOC Oversight (Shift Governance + On-Call Authority) Position Overview We are seeking a highly experienced SOC Level 3 Technical Lead to oversee advanced incident response, detection engineering, automation strategy, and SOC operational governance within a 24/7 Security Operations Center. This role carries technical escalation authority and operational responsibility, including roster planning and shift management, ensuring uninterrupted monitoring coverage in compliance with regulatory requirements set by the National Cybersecurity Authority (NCA). Saudi Nationals are strongly preferred in alignment with workforce nationalization initiatives. All regulatory and certification requirements must be satisfied prior to onboarding. Nationality Requirement ? Saudi National preferred ? Must reside in Jeddah or be willing to relocate before joining. Mandatory Regulatory & Certification Requirements (Audit-Critical) The following requirements are strictly mandatory: 1. Valid NCA Category A Certificate for a minimum of 3 years 2. Full compliance with Saudi Cybersecurity Workforce Framework (SCyWF) competency requirements for: o Advanced Incident Handling o Threat Analysis o Monitoring & Detection Engineering 3. Certification authenticity must be verifiable and documented. 4. Willingness to support 24/7 SOC operations, including on-call escalation. 5. Compliance with NCA frameworks including: o Essential Cybersecurity Controls (ECC) o Incident Management & Reporting Controls o Continuous Monitoring Requirements o Workforce Regulatory Controls Failure to meet any requirement will result in disqualification due to regulatory non-compliance. Core Responsibilities ?? Advanced Incident Response & Escalation Authority ? Lead handling of high-severity and critical cybersecurity incidents. ? Conduct deep forensic investigations and root cause analysis. ? Approve containment, eradication, and recovery strategies. ? Provide executive-level technical summaries and regulatory reporting inputs. ?? Threat Hunting & Detection Engineering ? Lead proactive threat hunting initiatives. ? Develop, tune, and optimize advanced SIEM detection rules. ? Align detection coverage with MITRE ATT&CK. ? Reduce false positives and improve detection efficiency. Experience required with SIEM platforms such as: ? Microsoft Sentinel ? Splunk ? IBM QRadar ?? SOAR & Automation Governance ? Design, review, and approve SOAR playbooks. ? Ensure automation workflows comply with approved Incident Response Plan. ? Oversee integration between SIEM, EDR, threat intelligence, and SOAR platforms. ? Continuously improve MTTR through automation optimization. ?? SOC Operations & Shift Governance ? Create and maintain SOC shift rosters ensuring 24/7 coverage. ? Manage analyst scheduling, rotation planning, and workload distribution. ? Ensure compliance with regulatory staffing and monitoring requirements. ? Monitor analyst performance and shift effectiveness. ? Coordinate leave planning to prevent monitoring gaps. ? Ensure proper shift handover procedures are followed and documented. ? Ensure proper review of alert/log health monitoring is completed. ? Escalate staffing risks that may impact compliance or monitoring continuity. ?? Technical Leadership & Team Management ? Mentor and technically supervise SOC L1 and L2 analysts. ? Review investigation quality and documentation standards. ? Conduct technical knowledge-sharing sessions. ? Participate in hiring and performance evaluation processes. ?? Compliance & Audit Oversight ? Ensure all incident cases are audit-ready. ? Validate evidence retention and documentation standards. ? Support internal compliance reviews and external regulatory audits. ? Ensure continuous adherence to NCA monitoring and workforce requirements.

Keyskills :