Senior Security Operations Engineer (SIEM/SOAR)

• Design, implement, and maintain advanced SIEM architectures, ensuring optimal performance and scalability for detecting sophisticated threats. • Develop and tune complex SIEM correlation rules and alerts to minimize false positives and maximize the detection of critical security incidents. • Engineer and deploy SOAR playbooks to automate incident response workflows, reducing manual effort and accelerating containment. • Lead threat hunting initiatives by proactively searching for and identifying advanced persistent threats (APTs) and novel attack vectors within the environment. Essential Requirements • 5–10 years' experience in security operations, SIEM engineering or a related cyber security role. • Proven hands-on experience deploying and configuring IBM QRadar (DSM configuration, custom properties, rules, reference data, apps). • Strong hands-on experience with Microsoft Sentinel : workspace design, data connectors, analytics rules, workbooks and automation. • Strong KQL skills, plus working knowledge of AQL . • Practical experience building SOAR playbooks and security automation. • Sound understanding of log sources, parsing, normalisation and data pipelines (Syslog, CEF, AMA, DCRs, APIs). • Good knowledge of the MITRE ATT&CK framework and detection engineering principles. • Working knowledge of Azure, Microsoft Defender XDR and Microsoft Entra ID. • Scripting ability in PowerShell and/or Python . Highly Desirable • SIEM migration experience , particularly QRadar to Microsoft Sentinel. • Banking or financial services experience , including familiarity with regulatory expectations for security monitoring (e.g., CBUAE, PCI DSS, SWIFT CSP). • Experience in large, regulated or 24x7 SOC environments. • Infrastructure-as-code experience for Sentinel deployment (ARM, Bicep, Terraform) and CI/CD for detection content. • Experience integrating threat intelligence platforms and EDR tools. Certifications (Preferred) • Microsoft Certified: Security Operations Analyst Associate ( SC-200 ) • IBM Certified QRadar SIEM Administrator / Deployment Professional • Relevant industry certifications such as GIAC (GCIA, GCIH, GCDA), CISSP or equivalent