SOC Engineer

Bevatel is seeking a SOC Engineer to design, operate, and continuously improve our Security Operations Center (SOC) capabilities.

This role is technical and operational, focused on real-time threat detection, incident response, log engineering, and SIEM/SOAR operations in a high-compliance environment.

You will play a critical role in protecting Bevatel's telecom, cloud, and platform infrastructure, while ensuring alignment with Saudi cybersecurity regulations and international best practices.

Responsibilities:

Security Monitoring & Detection

• Monitor security events across cloud, on-prem, network, endpoints, and applications
• Analyze alerts from SIEM, EDR, WAF, IDS/IPS, and cloud-native security tools
• Reduce false positives through tuning detection rules and correlation logic
• Develop and maintain use cases aligned to real attack scenarios
  
  

Incident Response

• Lead and execute security incident response (triage, containment, eradication, recovery)
• Perform root cause analysis (RCA) and document incidents clearly
• Coordinate with IT, DevOps, Network, and Management during incidents
• Support post-incident reviews and lessons learned
  
  

SIEM & Log Engineering

• Onboard and normalize logs from:
  
  

Cloud platforms

Firewalls, WAF, VPN

Identity systems

Applications and databases

• Create and maintain dashboards, alerts, and reports
• Ensure log retention and integrity in line with regulatory requirements
  
  

Threat Intelligence & Hunting

• Conduct proactive threat hunting
• Track and analyze threat intelligence feeds
• Map detections to MITRE ATT&CK
• Identify emerging attack patterns relevant to telecom and fin-tech environments
  
  

Compliance & Reporting

• Support compliance with:
  
  

NCA Essential Cybersecurity Controls (ECC / CCC)

SAMA Cybersecurity Framework (where applicable)

CST / CITC requirements

ISO 27001

• Prepare SOC reports, metrics, and evidence for audits and regulators
• Maintain clear SOC documentation and playbooks
  
  

Continuous Improvement

• Enhance SOC processes, playbooks, and response workflows
• Participate in SOC automation (SOAR) initiatives
• Improve SOC maturity, metrics (MTTD, MTTR), and operational efficiency
  
  

Requirements

Technical Skills

• Strong understanding of:
  
  

Security Operations & Incident Response

Networking (TCP/IP, DNS, HTTP, TLS)

Linux systems

• Hands-on experience with:
  
  

SIEM platforms (Splunk, Elastic, Wazuh, Sentinel, QRadar, etc.)

EDR / Endpoint Security

Firewalls, WAFs, IDS/IPS

• Experience analyzing:
  
  

Logs, network traffic, alerts, and system behavior

Cloud & Modern Environments

• Experience with cloud environments (AWS, GCP, Cloudflare)
• Familiarity with containers and Kubernetes security is a plus
• Understanding of IAM, API security, and application logs
  
  

Regulatory Awareness (Highly Preferred)

• Knowledge of Saudi cybersecurity regulations:
  
  

NCA ECC / CCC

SAMA CSF (for regulated environments)

CST requirements

• Experience supporting regulatory audits is a strong advantage.
  
  

Qualifications

• Bachelor's degree in Computer Science, Information Security, or related field
• 3–6 years experience in SOC, security operations, or incident response
• Certifications (preferred but not mandatory):
  
  

GCIA, GCIH, GCED

CEH, Security+

ISO 27001 or SOC-related certifications

Soft Skills

• Strong analytical and problem-solving skills
• Ability to stay calm under pressure during incidents
• Clear documentation and communication skills
• Team player with a security-first mindset
• High sense of ownership and accountability