Analyst - Security Operations
Job Fit Check
Base Career helps you apply smarter for this job.
Key skills for this role
About the Role
Core42 seeks a senior (L3) Incident Analyst for its 24x7 Security Operations Center in Abu Dhabi. The role involves detecting, triaging, investigating, and responding to security incidents across a private-cloud platform.
Key Skills for This Role
Responsibilities
- Monitor security alerts and events in Splunk to identify threats, anomalies and malicious activity across the private cloud platform and enterprise services
- Perform triage and investigation of security events, acting as the senior technical decision point on whether an alert represents a genuine incident
- Serve as the L3 escalation point for L1/L2 analysts, providing investigative guidance and validating findings before escalation
- Investigate EDR and NDR alerts involving malware, suspicious scripts, credential theft, lateral movement, persistence, ransomware and endpoint or network compromise
- Own security incidents end to end across the full response lifecycle: identification, containment, eradication, recovery and post incident review
- Execute containment and remediation actions in coordination with platform, infrastructure, network and application teams
- Lead the response on assigned incidents and coordinate cross team activity to ensure timely investigation, escalation and resolution
- Develop and maintain incident response playbooks and standard operating procedures (SOPs)
- Create, tune and optimize Splunk correlation searches, alerts, dashboards and reports to improve detection quality and coverage
- Write and maintain efficient SPL queries supporting investigation, hunting, reporting and detection engineering
- Reduce alert fatigue by tuning noisy detections, lowering false positives and strengthening correlation logic
- Support onboarding of new log sources and validate log quality, parsing, field extraction and normalization
Requirements
- Bachelor’s degree in Computer Science, Information Security, Cybersecurity or related field; equivalent experience and certifications considered
- 5–8 years in security operations, incident response or SOC monitoring, with at least 2 years at senior (L3) level
- Proven hands on experience with Splunk — advanced SPL, dashboard development, alert creation, correlation and administration
- Demonstrated experience with Cribl Stream/Edge — data routing, filtering, pipelines and log enrichment
- Strong background in incident analysis, investigation, evidence handling, escalation management and full lifecycle response
- Proficiency in Python, Bash or PowerShell for automation and analysis
- Strong understanding of TCP/IP, DNS, HTTP/S, firewalls, proxies and IDS/IPS
Full Job Posting
About Us
- Core42, a leader in AI powered cloud and digital infrastructure, is driving transformative technology solutions globally.
The opportunity
- We are looking for a senior (L3) Incident Analyst to anchor the technical depth of our 24×7 Security Operations Center.
Your key responsibilities
- Monitor security alerts and events in Splunk to identify threats, anomalies and malicious activity across the private cloud platform and enterprise services.
- Perform triage and investigation of security events, acting as the senior technical decision point on whether an alert represents a genuine incident.
- Serve as the L3 escalation point for L1/L2 analysts, providing investigative guidance and validating findings before escalation.
- Investigate EDR and NDR alerts involving malware, suspicious scripts, credential theft, lateral movement, persistence, ransomware and endpoint or network compromise.
- Own security incidents end to end across the full response lifecycle: identification, containment, eradication, recovery and post incident review.
- Execute containment and remediation actions in coordination with platform, infrastructure, network and application teams.
- Lead the response on assigned incidents and coordinate cross team activity to ensure timely investigation, escalation and resolution.
- Develop and maintain incident response playbooks and standard operating procedures (SOPs), and drive their improvement after each major incident.
- Create, tune and optimize Splunk correlation searches, alerts, dashboards and reports to improve detection quality and coverage.
- Write and maintain efficient SPL queries supporting investigation, hunting, reporting and detection engineering.
- Reduce alert fatigue by tuning noisy detections, lowering false positives and strengthening correlation logic.
- Support onboarding of new log sources and validate log quality, parsing, field extraction and normalization.
What we’re looking for
- Bachelor’s degree in Computer Science, Information Security, Cybersecurity or a related field; equivalent professional experience and certifications will be considered.
- 5–8 years in security operations, incident response or SOC monitoring, with at least 2 years at a senior (L3) or equivalent level.
- Proven hands on experience with Splunk — advanced SPL, dashboard development, alert creation, correlation and administration.
- Demonstrated experience with Cribl Stream/Edge — data routing, filtering, pipelines and log enrichment.
- Strong background in incident analysis, investigation, evidence handling, escalation management and full lifecycle response.
- Proficiency in Python, Bash or PowerShell for automation and analysis.
- Strong understanding of TCP/IP, DNS, HTTP/S, firewalls, proxies and IDS/IPS.
- Proficiency in Windows and Linux environments.
- Familiarity with private cloud and platform log sources — Red Hat OpenShift, OpenStack, Commvault, Scality and related infrastructure.
- Experience with ServiceNow, Jira or equivalent for incident tracking.
Preferred certifications
- Splunk Core Certified Power User or Splunk Certified Admin
- Cribl Certified Admin
- GIAC certifications relevant to detection and response — GCIA, GCIH, GCDA or GCFA
- Blue Team Level 2 (BTL2) or equivalent hands on defensive certification
What working at Core42 offers
- Competitive Salary: We offer an attractive salary package based on your skills and experience.
- Yearly Bonus: In recognition of your contributions, you will receive a performance based annual bonus.
- Exclusive Discount Cards: Access special benefits with Esaad and Fazaa cards.
- Premium Family Insurance: Comprehensive health coverage including dental, vision and life insurance.
- Learning & Development: Access to top tier learning platforms.
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer
More jobs at Core42
Senior Site Reliability Engineer
Abu Dhabi Emirate, UAE
Core42 seeks a Senior Site Reliability Engineer to design, implement, and operate scalable infrastructure for AI and HPC workloads. The role involves CI/CD pipelines, Kubernetes, observability, and incident management. C
Senior Engineer - DC Network Engineering
Abu Dhabi Emirate, UAE
Core42 seeks a Senior Engineer for Data Centre Network Engineering to design, optimize, and secure network infrastructure supporting cloud and AI workloads. The role requires deep expertise in L2/L3 networking, routing p
Legal Director
Abu Dhabi Emirate, UAE
Core42 seeks a visionary Legal Director to lead commercial contracts and provide legal advice across the organization. The role requires a qualified lawyer with 8+ years of post-qualification experience in commercial law
Senior Engineer - HPC Operations
Abu Dhabi Emirate, UAE
Lead daily operations of HPC clusters for AI/ML workloads, ensuring performance and reliability. Requires 7+ years of HPC operations experience with Slurm, Kubernetes, GPU management, and automation skills.
Supply Chain Lead
Abu Dhabi Emirate, UAE
Core42 seeks a hands-on Supply Chain Lead to own end-to-end sourcing execution and delivery assurance for AI infrastructure (GPU, servers, networking, data center components). This role focuses on supplier expediting, or
Specialist - Talent Sourcing
Abu Dhabi, UAE
Core42 is seeking a motivated professional to join their team in Abu Dhabi. The role involves participating in cross-functional projects, providing innovative solutions, and maintaining clear communication. Ideal candida
Program Executive
Abu Dhabi Emirate, UAE
Core42 is seeking a Program Executive to support the Program Management department in Abu Dhabi. The role coordinates day-to-day process, documentation, and reporting activities, supports compliance and governance routin
Senior Software Engineer (Go)
Abu Dhabi Emirate, UAE
Core42 is hiring a Senior Software Engineer (Go) to architect, scale, and maintain backend services for AI-powered cloud infrastructure. The role requires deep expertise in Go, Kubernetes, and cloud-native development, w
Senior Site Reliability Engineer
Abu Dhabi Emirate, UAE
Senior Engineer - DC Network Engineering
Abu Dhabi Emirate, UAE
Legal Director
Abu Dhabi Emirate, UAE
Senior Engineer - HPC Operations
Abu Dhabi Emirate, UAE
Supply Chain Lead
Abu Dhabi Emirate, UAE
Specialist - Talent Sourcing
Abu Dhabi, UAE
Program Executive
Abu Dhabi Emirate, UAE
Senior Software Engineer (Go)
Abu Dhabi Emirate, UAE