General Description:
Join a dynamic cybersecurity team responsible for monitoring, analyzing, and responding to security events across enterprise systems. The CDC L2 Analyst will conduct in-depth investigations of escalated alerts, perform triage to identify real threats, and take initial containment actions, helping maintain a secure and resilient IT environment.
This role blends technology, security operations, and compliance, providing a key contribution to proactive threat detection and incident response initiatives.
Key Responsibilities:
- Monitor and analyze security alerts from SIEM, SOAR, EDR, WAF, API gateways, and cloud services.
- Perform Level 2 triage to validate true positives, eliminate false positives, and detect malicious behavior.
- Conduct deep-dive investigations across endpoints, identities, APIs, networks, and cloud services.
- Execute initial containment measures such as account lockout, isolation, or token revocation.
- Escalate complex incidents with complete investigation notes and evidence.
- Document incidents and actions with regulatory-aligned traceability.
- Support threat hunting activities and propose new detection rules and playbooks.
- Analyze cloud security events, including IAM anomalies, API misuse, container threats, and serverless misuse.
- Validate and improve monitoring rules and playbooks.
- Provide structured handovers to other security teams and stakeholders.
- Participate in post-incident reviews and continuous improvement initiatives.
Educational Qualifications:
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or equivalent.
Technical Expertise:
- Security monitoring & incident response (SIEM, SOAR, EDR, WAF, API gateways, cloud logs)
- Endpoint, network, identity, and cloud security analysis
- Threat detection, triage, and containment
- Incident documentation aligned with regulatory standards
Professional Experience:
- Minimum 35 years in cybersecurity monitoring, SOC operations, or incident response
- Experience handling escalated security alerts (L2 triage)
- Exposure to multi-team and multi-vendor IT environments
- Banking, FinTech or financial services cybersecurity experience is a plus
Other Skills:
- Strong analytical and problem-solving capabilities
- Excellent communication and collaboration skills
- Ability to work independently in a hybrid environment
- Highly organized with attention to detail
- Proactive and accountable for security outcomes
Engagement Details:
- Engagement Type: Project-based / Consulting
- Start Date: ASAP (2-months notice acceptable)
- Work Setup: Hybrid Riyadh, KSA (3x a week on-site)
- Visa Requirement: Open to IQAMA holders
