Security Engineer / SOC Lead

Role Overview

Security Engineer / SOC Lead at BlackStone eIT. Onsite operational security focal point responsible for coordinating security monitoring, incident response, technical remediation and reporting with a shared SOC. Policy ownership, regulatory accountability and risk acceptance remain with the Entity.

Role Purpose

Lead operational security coordination and incident response activities, serving as the primary onsite contact between the organization and shared SOC. Ensure security events are properly escalated, investigated and resolved within approved procedures while maintaining clear evidence trails and stakeholder accountability.

Key Responsibilities

Security Monitoring & Alert Management

• Coordinate security monitoring, alert triage and escalation with the shared SOC and relevant technical teams.
• Support security logging, SIEM integration, use-case tuning and monitoring coverage assessments.
• Provide operational security reporting and support agreed awareness, exercise or readiness activities.

Incident Response & Evidence Management

• Lead operational response to confirmed security incidents in accordance with approved procedures and authority.
• Collect and preserve technical evidence and maintain incident records, timelines and action tracking.
• Coordinate containment, remediation, recovery and post-incident reviews with stakeholders.
• Ensure incident evidence, decisions, actions and dependencies remain traceable.

Risk & Compliance Oversight

• Track technical security risks and remediation dependencies across infrastructure, network, cloud and applications.
• Escalate policy, compliance and risk-acceptance decisions to the authorized Entity function.
• Ensure policy and risk decisions are not assumed without Entity authority.

Stakeholder Coordination

• Ensure the shared SOC and onsite teams operate with clear ownership and handoffs.
• Support strong written reporting and stakeholder coordination.

Qualifications & Experience

• Minimum 5 years of cybersecurity operations, SOC or incident-response experience.
• Practical experience with SIEM platforms such as Splunk, QRadar or equivalent.
• Strong knowledge of security monitoring, incident handling, network/endpoint telemetry and threat analysis.
• Strong written reporting, stakeholder coordination and evidence-handling capability.
• Security+, CEH, GCIA or equivalent certification preferred.
• Previous experience supporting UAE government or regulated security environments preferred.
• Working knowledge of TDRA security, hosting and incident coordination processes preferred.

Skills & Competencies

• Arabic language capability for onsite stakeholder coordination preferred.