موظف موارد بشرية Senior Threat Detection Specialist بدوام كامل في الإمارات العربية المتحدة
التخصص
تكنولوجيا المعلومات
نوع الدوام
دوام كامل
الخبرة
أي مستوى
الموقع
الإمارات العربية المتحدة
وصف الوظيفة
We're Hiring: Senior Threat Detection SpecialistLocation: United Arab Emirates (Remote)Employment Type: Full-TimeExperience Level: SeniorWork Arrangement: Fully RemoteAbout UsWe are a globally focused organization committed to protecting digital infrastructure, applications, data, and business operations from evolving cyber threats. Our security teams work across Security Operations, Engineering, Infrastructure, Cloud, Identity, Risk, Compliance, Data, and external security partners to strengthen threat visibility and organizational resilience.We use modern detection engineering, security analytics, threat intelligence, automation, and continuous monitoring to identify malicious activity early, reduce response times, and improve the organization's overall security posture.The RoleWe are seeking an experienced Senior Threat Detection Specialist to lead threat detection engineering, security monitoring, detection analytics, threat hunting, and continuous improvement of security detection capabilities.The ideal candidate will combine strong knowledge of cyber threats with expertise in SIEM, EDR/XDR, network security, cloud security, identity security, log analysis, detection engineering, threat intelligence, and security automation. The role will develop high-quality detections, investigate emerging attack techniques, reduce false positives, and work closely with incident-response and security-engineering teams to improve detection coverage.Key ResponsibilitiesDevelop and implement threat-detection strategies aligned with organizational security objectives.Design, develop, test, deploy, and maintain security detection rules and analytics.Build detection capabilities across endpoints, networks, cloud environments, applications, identities, and security infrastructure.Develop detections for malware, credential theft, lateral movement, privilege escalation, persistence, command execution, data exfiltration, and other malicious activity.Map detection coverage to established adversary tactics, techniques, and procedures.Use frameworks such as MITRE ATT&CK to identify detection gaps and prioritize improvements.Develop behavioral and analytics-based detections for suspicious activity and anomalous behavior.Analyze security telemetry from SIEM, EDR, XDR, NDR, IDS/IPS, firewalls, identity platforms, cloud services, applications, and other security tools.Develop and optimize SIEM correlation rules, queries, alerts, and detection logic.Create advanced queries using relevant security-query languages and analytics platforms.Tune detection rules to improve signal quality and reduce false positives.Investigate recurring alerts and identify opportunities for improved detection precision.Establish detection thresholds, suppression logic, enrichment, prioritization, and alert-routing mechanisms.Develop detection logic for known indicators of compromise and emerging attack patterns.Incorporate threat-intelligence indicators, behavioral patterns, and adversary techniques into detection capabilities.Monitor threat-intelligence feeds and assess their relevance to the organization's technology environment.Conduct proactive threat hunting to identify previously undetected malicious activity.Develop threat-hunting hypotheses based on threat intelligence, incidents, vulnerabilities, and observed attacker behavior.Investigate anomalous activity across endpoints, identities, networks, cloud environments, and applications.Perform retrospective searches across historical security telemetry to identify potential compromise.Support incident-response teams by developing detection queries, investigative searches, and technical indicators.Analyze security incidents to identify detection opportunities and improve future prevention and monitoring.Conduct post-incident detection reviews and implement lessons learned.Develop detections for newly discovered vulnerabilities, exploits, malware families, and attack campaigns.Assess security alerts generated by new technologies, applications, infrastructure, and cloud services.Establish detection requirements for new systems before production deployment.Work with engineering teams to ensure appropriate security logging and telemetry are available.Identify missing, incomplete, or low-quality security telemetry and coordinate remediation.Define log-source onboarding requirements, parsing standards, normalization, and data-quality expectations.Validate that critical security events are correctly collected, normalized, enriched, and searchable.Develop detection content for Windows, Linux, macOS, network devices, cloud platforms, containers, and enterprise applications where applicable.Develop identity-focused detections covering suspicious authentication, privilege escalation, credential abuse, impossible travel, anomalous access, and account compromise.Develop cloud-security detections covering unusual API activity, privilege changes, suspicious resource creation, credential misuse, and abnormal access patterns.Develop endpoint detections for suspicious processes, scripts, command execution, persistence mechanisms, and malicious behavior.Develop network detections for unusual connections, command-and-control activity, scanning, lateral movement, and data exfiltration.Develop application and database detections for suspicious administrative activity, abnormal access, injection attempts, and unauthorized data access.Evaluate detection effectiveness through controlled testing, purple-team exercises, simulations, and attack emulation.Collaborate with penetration testing, red-team, vulnerability-management, and security-engineering teams to improve detection coverage.Develop detection test cases and validation procedures for critical detection rules.Monitor detection performance and investigate detections that fail to identify known attack scenarios.Maintain detection content through controlled versioning, peer review, testing, deployment, and retirement processes.Establish detection-development standards, documentation requirements, naming conventions, and quality controls.Maintain an accurate inventory of detection rules, data sources, coverage areas, owners, dependencies, and review dates.Develop dashboards and reporting covering detection coverage, alert quality, threat activity, and detection performance.Track detection gaps, false positives, false negatives, tuning activities, and remediation progress.Identify opportunities to automate repetitive detection-development, enrichment, investigation, and response activities.Integrate detection platforms with SOAR, case-management, threat-intelligence, ticketing, and security-automation tools.Key Performance IndicatorsThreat detection coverageMITRE ATT&CK technique coverageCritical threat detection coverageDetection rule effectivenessTrue-positive detection rateFalse-positive rateFalse-negative rateAlert-to-incident conversion rateMean time to detectMean time to triageMean time to investigateMean time to escalateDetection alert volumeHigh-severity alert accuracyDetection tuning effectivenessDetection rule review completionDetection rule test coverageDetection validation success rateThreat-hunting activity completionThreat-hunting finding rateConfirmed threat discovery rateRetrospective threat-search coverageSecurity telemetry coverageCritical log-source onboardingLog-source data qualitySecurity event ingestion reliabilityDetection content deployment successDetection change failure rateDetection automation coverageAutomated enrichment rateSOAR workflow effectivenessIncident-driven detection improvementsDetection gap remediation rateVulnerability-driven detection coverageEmerging-threat detection deployment timeNew-threat detection response timeCloud detection coverageEndpoint detection coverageIdentity detection coverageNetwork detection coverageApplication detection coverageDetection documentation completenessDetection inventory accuracyDetection platform availabilityPurple-team detection validation re
التعليقات
لا توجد تعليقات منشورة حتى الآن.