تسلم تعلن عن وظيفة مهندس أمن SIEM وسحابي في مكة

SIEM & Cloud Security Engineer | Teslm | Makkah, Saudi Arabia | On-site | Immediate start

One seat, full scope: the SIEM end to end, and the security of our cloud.

We're hiring one engineer to own both sides of the job: our Google SecOps SIEM end to end, and the security of our AWS estate. If you only do one of the two, this isn't your role - if you do both, you'll rarely find this much scope in one seat.

What you'll do

Own Google SecOps (Chronicle) Enterprise end to end, hosted in-Kingdom: log-source onboarding (CloudTrail, EKS, WAF/ALB, DNS, VPC Flow Logs, custom application events), curated detections, and writing and tuning our own YARA-L rules for authentication, payment, and ERP abuse patterns

Own the log-integrity architecture: immutable WORM evidence vault (S3 Object Lock), organization-wide guardrails (SCP/RCP), watch-the-watcher tamper alerting, and cross-region log DR

Harden AWS and EKS: Security Hub against CIS benchmarks, GuardDuty including runtime monitoring, Inspector, WAF rules including checkout rate-limiting, IAM least privilege, KMS, Secrets Manager

Secure our production environment: Terraform-driven controls, immutable backups (AWS Backup Vault Lock), and container/CI-CD security with Trivy, gitleaks, and Dependabot

Run incident response with the team on a small on-call rota (Grafana IRM): triage, containment, post-incident review

Support compliance engineering across PCI DSS (quarterly ASV scans), NCA NCNICC-1:2025, and PDPL - including log redaction and breach-notification evidence

What you'll bring

Minimum 3 years of hands-on experience covering both SIEM/detection engineering and cloud security - both are firm requirements, not either/or

Real detection engineering: you've onboarded log sources, written and tuned rules, and lived with the false positives. Google SecOps/Chronicle preferred; strong Splunk, Sentinel, or Elastic engineers ready to ramp onto YARA-L are welcome

AWS security depth: CloudTrail, GuardDuty, Security Hub, IAM, KMS, S3 security; Kubernetes/EKS security a strong plus

Python scripting and Terraform familiarity

Solid incident response fundamentals and willingness to join a small on-call rotation

Strong professional English - our working language (Arabic not required)

Currently residing in Saudi Arabia - we are only considering candidates already in the Kingdom (sponsorship handled by us)

Available immediately or on short notice - this is an urgent hire and we're moving quickly

This role is fully on-site in Makkah - applicants must be legally eligible to live and work in Makkah city

Nice to have

AWS Security Specialty, GCIH/GCDA, or CKS certifications

Experience securing e-commerce or payments platforms

Familiarity with the Saudi regulatory landscape (NCA, SDAIA/PDPL, PCI)