SOC Engineer

Black & Grey HR is recruiting for an established technology solutions and services provider in Doha, Qatar. Our client is seeking a SOC Engineer to strengthen its Security Operations Center (SOC) by monitoring, detecting, investigating, and responding to cybersecurity incidents across enterprise IT environments. This role is ideal for professionals with hands-on SOC experience who are passionate about threat detection, incident response, and maintaining a strong organizational security posture.

Key Responsibilities

Security Monitoring & Incident Detection

• Monitor security alerts generated from SIEM, XDR, EDR, NDR, IDS/IPS, firewalls, and cloud security platforms.
• Identify, validate, triage, and prioritize security incidents based on severity, impact, and business risk.
• Continuously monitor security events to detect malicious activities and potential threats. Incident Response & Threat Investigation
• Investigate security incidents and perform root cause analysis.
• Analyze malware, attack techniques, and suspicious activities to determine impact and remediation actions.
• Coordinate containment, eradication, and recovery activities with internal teams.
• Escalate high-severity incidents following established incident response procedures. Threat Hunting & Detection Engineering
• Perform proactive threat hunting activities using scheduled queries and threat intelligence.
• Monitor threat hunting dashboards and validate suspicious indicators of compromise.
• Identify emerging attack patterns and recommend improvements to detection capabilities. Vulnerability Management & Security Operations
• Review vulnerability assessment results and monitor remediation progress.
• Validate patch implementation and ensure timely closure of remediation activities.
• Support day-to-day security operations and ensure compliance with operational procedures. Reporting & Operational Excellence
• Maintain accurate incident records, investigation notes, and ticket updates.
• Prepare daily operational reports, shift handover documentation, and incident summaries.
• Ensure compliance with defined SLAs and operational performance metrics.
• Contribute to continuous improvement of SOC processes and security operations.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field. - 1–4 years of hands-on experience working in a Security Operations Center (SOC).
• Experience monitoring SIEM, EDR/XDR, IDS/IPS, firewalls, email security, and cloud security platforms.
• Good understanding of incident triage, security event classification, escalation procedures, and ticket management.
• Strong understanding of networking fundamentals including TCP/IP, DNS, HTTP/HTTPS, VPN, routing, switching, and common network protocols.
• Experience working with Windows and Linux operating systems, endpoint security, and system log analysis.
• Knowledge of common cyber threats including phishing, ransomware, malware, brute force attacks, web attacks, and insider threats.
• Preferred certifications: o CompTIA Security+ o CompTIA CySA+ o EC-Council Certified Network Defender (CND) o Cisco CyberOps Associate o Microsoft SC-200
• Additional certifications such as CHFI or DFIR Foundations will be an advantage. Required Skillset
• Security Information & Event Management (SIEM) monitoring and alert analysis.
• Endpoint Detection & Response (EDR/XDR) and Network Detection & Response (NDR).
• Incident detection, triage, investigation, and response.
• Threat hunting and threat intelligence analysis.
• Vulnerability management and remediation tracking.
• Log analysis across endpoints, servers, firewalls, proxies, Active Directory, cloud platforms, and security appliances.
• Basic scripting skills using PowerShell, Python, or Bash for automation and log analysis.
• Strong documentation, communication, and incident reporting skills.
• Ability to work in a 24×7 SOC environment and collaborate effectively during security incidents.

Benefits

• Competitive Salary + Benefits Package