System Operator for Internet

Job Summary

Key Responsibilities

• Operate and support firewalls, WAF, SIEM, antivirus, EDR, proxy, IDS/IPS, and related security technologies.
• Continuously monitor security alerts, events, and incidents across the environment.
• Identify, classify, prioritize, and investigate events from network devices, proxies, IDS/IPS, antivirus, EDR, databases, servers, and endpoints.
• Classify incidents according to type, impact, and severity.
• Notify system administrators, follow incident response procedures, escalate incidents, and document actions taken.
• Investigate cybersecurity incidents, track cyberattacks, and gather information about attackers and attack methods.
• Analyze incidents reported by the National Cybersecurity Authority and coordinate appropriate actions.
• Create, review, and update SIEM and security monitoring use cases for new systems and applications.
• Resolve cybersecurity-related service requests and user issues.
• Coordinate with departments and technical teams during security incident investigations and resolution.
• Monitor compliance with MNG-HA technical security standards and support remediation of identified gaps.
• Maintain approved security system versions and prepare monthly cybersecurity reports.

Required Skills and Experience

• Experience in cybersecurity operations, a SOC, security monitoring, or security engineering.
• Hands-on experience with firewalls, WAF, SIEM, EDR, antivirus, proxy, and IDS/IPS technologies.
• Strong understanding of security event monitoring, incident classification, investigation, escalation, and response.
• Experience analyzing logs and security events from network devices, servers, endpoints, databases, and security tools.
• Knowledge of incident response processes and cybersecurity best practices.
• Ability to develop and maintain security monitoring and SIEM use cases.
• Strong analytical, troubleshooting, documentation, and communication skills.

Preferred Qualifications

• Experience working in a 24×7 SOC or security operations environment is an advantage.
• Security+, CySA+, CEH, GCIH, or an equivalent cybersecurity certification is preferred.

Workplace

• The description identifies the work location as VaporVM IT Services DMCC but does not explicitly state a remote, hybrid, onsite, or field arrangement.