أكيوتيف ميدل إيست تعلن عن وظيفة مدير عمليات أمن في مكة وجدة

Job Summary

The Security Operations Lead is responsible for leading the organization's Security Operations Center (SOC) and ensuring the effective monitoring, detection, investigation, and response to cybersecurity threats. This role oversees security analysts, drives continuous improvement of security processes, manages security technologies, and works closely with IT, infrastructure, and business stakeholders to strengthen the organization's overall security posture.

Key Responsibilities

• Lead and manage daily Security Operations Center (SOC) activities.
• Supervise, mentor, and develop Tier 1, Tier 2, and Tier 3 security analysts.
• Monitor security alerts and incidents to ensure timely investigation and resolution.
• Lead incident response activities, including containment, eradication, recovery, and post-incident reviews.
• Develop and maintain incident response playbooks, standard operating procedures (SOPs), and escalation processes.
• Coordinate security investigations with internal teams and external partners.
• Oversee the operation and optimization of security platforms, including:
• SIEM (e.g., Splunk, Microsoft Sentinel, Elastic Security, QRadar)
• EDR/XDR
• SOAR
• IDS/IPS
• Email Security
• Threat Intelligence Platforms
• Vulnerability Management tools
• Review, tune, and optimize security detection rules and use cases to minimize false positives and improve threat detection.
• Manage vulnerability remediation efforts with infrastructure and application teams.
• Produce security metrics, dashboards, and executive reports on SOC performance and security posture.
• Ensure compliance with security policies, standards, and regulatory requirements.
• Conduct threat hunting activities and oversee proactive security monitoring.
• Support security audits and compliance assessments.
• Coordinate with third-party MSSPs and security vendors where applicable.
• Lead cyber incident tabletop exercises and improve organizational readiness.
• Stay current with emerging cyber threats, attack techniques, and security technologies.

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• 7+ years of experience in cybersecurity, with at least 3 years in a leadership or senior SOC role.
• Strong understanding of:
• Security Operations Center (SOC) processes
• Incident Response
• Threat Intelligence
• Threat Hunting
• Security Monitoring
• Cyber Kill Chain
• MITRE ATT&CK Framework
• NIST Cybersecurity Framework
• Experience leading security incident investigations.
• Hands-on experience with SIEM platforms such as Splunk, Elastic Security, Microsoft Sentinel, or QRadar.
• Strong knowledge of Windows, Linux, Active Directory, cloud security (AWS, Azure, OCI, or GCP), and networking fundamentals.
• Experience with endpoint detection and response (EDR/XDR) solutions.
• Familiarity with scripting (PowerShell, Python, Bash) for automation is preferred.

Preferred Certifications

• CISSP
• GCIA
• GCIH
• GCFA
• CEH
• CompTIA Security+
• Splunk Enterprise Security Certified Admin (or equivalent SIEM certification)
• Microsoft SC-200 (if using Microsoft Sentinel)

Technical Skills

• SIEM Management
• Incident Response
• Digital Forensics (basic to intermediate)
• Threat Hunting
• Malware Analysis (basic understanding)
• Log Analysis
• SOAR Automation
• Endpoint Security
• Network Security
• Firewall Technologies
• IDS/IPS
• Email Security
• Cloud Security
• Vulnerability Management
• Security Monitoring
• Security Reporting and Metrics

Leadership & Soft Skills

• Strong leadership and team management skills.
• Excellent communication and stakeholder management.
• Ability to make decisions during high-pressure security incidents.
• Strong analytical and problem-solving skills.
• Experience mentoring and developing security professionals.
• Ability to manage multiple priorities in a fast-paced environment.
• Excellent documentation and reporting skills.

Key Performance Indicators (KPIs)

• Mean Time to Detect (MTTD)
• Mean Time to Respond (MTTR)
• Incident resolution SLA compliance
• Reduction in false-positive alerts
• Detection coverage across critical assets
• Vulnerability remediation compliance
• Security monitoring availability
• SOC process maturity improvements
• Threat hunting effectiveness
• Audit and compliance readiness