linkedin
Cyber Security Lead
EVOTEQ
Dubai, UAE
Full Time
Lead
Onsite
2 days ago
Microsoft SentinelKQLMicrosoft Defender XDRAzure SecurityMicrosoft PurviewZscaler
Free
Job Fit Check
Base Career helps you apply smarter for this job.
?%
Ready to ScanKey skills for this role
Microsoft SentinelKQLMicrosoft Defender XDR
About the Role
EVOTEQ seeks a hands-on Cyber Security Lead to own technical security operations, including SOC, vulnerability management, and cloud security. The role involves investigating incidents, writing KQL detections, building automation, and applying AI to improve detection and response.
Key Skills for This Role
Microsoft SentinelKQLMicrosoft Defender XDRAzure SecurityMicrosoft PurviewZscaler
Responsibilities
- Lead investigations into security alerts and incidents across Microsoft Sentinel and Defender XDR
- Act as incident commander for major and critical incidents, performing technical analysis and running response
- Write and run advanced KQL queries for investigation, hunting and detection across Sentinel and Defender XDR
- Build, tune and maintain analytics rules and use cases mapped to MITRE ATT&CK
- Develop and maintain SOAR automation using Sentinel playbooks and Azure Logic Apps
- Run threat hunting, purple team activities, tabletop exercises and post incident reviews
- Find, pilot and put into production practical AI use cases across the SOC
- Use Microsoft Security Copilot and agentic capabilities for alert triage, incident summarization, and KQL generation
- Design and build AI assisted and agentic automation inside Sentinel and Logic Apps
- Evaluate, design, deploy and operationalize new security solutions across the Microsoft stack and beyond
- Continuously harden the environment and improve tooling, integrations and automation across Sentinel, Defender, Purview, Azure and Zscaler
- Own the vulnerability management lifecycle on the technical side
Requirements
- Bachelor's degree in Computer Science, Information Security or related field, or equivalent hands on experience
- Around 10 years in cyber security, with deep hands on experience in security operations and incident response
- Strong, demonstrable hands on experience with Microsoft security stack (Sentinel, Defender XDR, Azure, Purview)
- A track record of personally investigating and resolving security incidents, including major ones
- Real experience applying AI and automation to security operations in an operational way
- Broad knowledge across security domains: operations, vulnerability management, cloud, identity, network, application and data protection
- Experience overseeing MSSP or outsourced delivery while staying technically involved
Full Job Posting
Role Overview
- This is a hands on, technically deep security operations role. You own the technical side of how the organization detects and responds to threats across Microsoft Sentinel, Defender for Endpoint, Purview, Azure and Zscaler.
- You investigate incidents, write and tune detections in KQL, build automation, and go into the data yourself.
- You are responsible for SOC, Vulnerability Management and Cloud Security.
- You are also expected to bring AI into day to day security operations in a real way.
Responsibilities
- Lead investigations into security alerts and incidents across Microsoft Sentinel and Microsoft Defender XDR.
- Act as incident commander for major and critical incidents, doing the technical analysis as well as running the response.
- Write and run advanced KQL queries for investigation, hunting and detection across Sentinel and Defender XDR.
- Build, tune and maintain analytics rules and use cases mapped to MITRE ATT&CK.
- Develop and maintain SOAR automation using Sentinel playbooks and Azure Logic Apps.
- Run threat hunting, purple team activities, tabletop exercises and post incident reviews.
- Find, pilot and put into production practical AI use cases across the SOC.
- Use Microsoft Security Copilot and agentic capabilities for alert triage, incident summarization, faster investigation, hunting and KQL generation.
- Design and build AI assisted and agentic automation inside Sentinel and Logic Apps.
- Evaluate, design, deploy and operationalize new security solutions across the Microsoft stack and beyond.
- Continuously harden the environment and improve tooling, integrations and automation across Sentinel, Defender, Purview, Azure and Zscaler.
- Own the vulnerability management lifecycle on the technical side.
Required Qualifications
- Bachelor's degree in Computer Science, Information Security or a related field, or equivalent hands on experience.
- Around 10 years in cyber security, with deep hands on experience in security operations and incident response.
- Strong, demonstrable hands on experience with the Microsoft security stack, including Sentinel, Defender XDR, Azure and Purview.
- A track record of personally investigating and resolving security incidents, including major ones.
- Real experience applying AI and automation to security operations in an operational way.
- Broad knowledge across security domains, including operations, vulnerability management, cloud, identity, network, application and data protection.
- Experience overseeing MSSP or outsourced delivery while staying technically involved.
Technical Skills
- Microsoft Sentinel: analytics rules, KQL, workbooks, automation rules and playbooks (Logic Apps).
- Microsoft Defender XDR: investigation, advanced hunting, response and tuning.
- Advanced KQL for hunting, detection and analysis.
- Microsoft Purview: sensitivity labels / AIP and DLP policy design, tuning and investigation.
- Azure security: Defender for Cloud, Entra ID, secure configuration and posture management.
- Zscaler (ZIA/ZPA) policy and telemetry integration.
- Secure configuration and system hardening across endpoints, servers and infrastructure.
- Application security fundamentals.
- Network security concepts.
- Applied AI for security: Microsoft Security Copilot, agentic and automated workflows.
- Scripting and automation: KQL, PowerShell and Python.
- Solid grasp of incident response frameworks (NIST IR / SANS) and MITRE ATT&CK.
Certifications (Preferred)
- Microsoft: SC 200, SC 500, SC 100, SC 401.
- GIAC hands on certifications such as GCIH, GCIA, GCFA and GMON.
- CISSP or CISM.
- Zscaler certifications (ZIA/ZPA) are a plus.
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career