Defense Engineer - System Operator (RE)

About the Company

Responsibilities

• ● Monitor and manage cybersecurity systems and security controls, including EDR, AV, SIEM, WAF, Firewall, NAC, Proxy, and HX.
• ● Continuously monitor security alerts and events, classify incidents based on severity and impact, and take appropriate action.
• ● Assess security incidents and follow established incident response procedures.
• ● Notify relevant system owners.
• ● Initiate appropriate incident response actions.
• ● Escalate incidents according to defined procedures.
• ● Document incident details, findings, and actions taken.
• ● Investigate cybersecurity incidents and cyberattacks and analyze relevant security events and indicators.
• ● Document, track, and report cybersecurity incidents in accordance with established procedures.
• ● Handle and follow up on users' Service Requests related to information security.
• ● Create, develop, and update security use cases for existing and newly implemented security systems and applications.
• ● Analyze cybersecurity incidents and security events and report them through the Saudi Cybersecurity Authority channels, where applicable.
• ● Conduct regular security scans to identify vulnerabilities, security gaps, and potential threats.
• ● Ensure compliance with applicable cybersecurity standards, policies, and requirements approved by the Information Technology Administration.
• ● Coordinate with relevant departments and system owners during cybersecurity investigations and incident response activities.
• ● Prepare monthly reports summarizing major cybersecurity incidents, findings, trends, and actions taken.
• ● Maintain and operate security systems and ensure they are updated to the latest approved versions.
• ● Identify, classify, and prioritize security events and incidents collected through security controls, including firewalls, network and proxy devices, IDS/IPS systems, antivirus solutions, databases, and endpoints.
• ● Support the continuous improvement of security monitoring, incident detection, and response processes.
• ● Perform other cybersecurity monitoring, investigation, and incident response duties as assigned.

Requirements

• ● 5+ years of relevant experience in cybersecurity, security operations, or a related field.
• ● Required Certifications: CISSP or CASP+ and CCNA.
• ● Strong knowledge of cybersecurity monitoring, threat detection, incident investigation, and incident response.
• ● Hands-on experience with security monitoring and protection technologies, including SIEM, EDR/AV, WAF, Firewalls, NAC, Proxy, HX, IDS/IPS, databases, and endpoint security solutions.
• ● Ability to analyze security alerts and events, assess risks, prioritize incidents, and follow established incident response procedures.
• ● Knowledge of vulnerability assessment, security scanning, and cybersecurity controls.
• ● Strong analytical, problem-solving, documentation, reporting, communication, and coordination skills.