Threat Detection Engineer
Job Fit Check
Base Career helps you apply smarter for this job.
Key skills for this role
About the Role
COGNNA seeks a Threat Detection Engineer to design detection strategies, build automation, and elevate SOC operations in Riyadh. The role involves developing high-fidelity correlation rules, optimizing SIEM/EDR platforms, and mentoring cyber talent.
Key Skills for This Role
Responsibilities
- Build high fidelity correlation rules and behavioral detections within COGNNA security platforms
- Translate adversary TTPs (MITRE ATT&CK), threat intel, and vulnerability data into actionable logic
- Identify detection gaps and introduce new data sources to cover evolving threat landscapes
- Automate detection testing and maintain detection quality over time
- Lead architecture and optimization of XDR, SIEM, and SOC tech stacks for scale and resilience
- Streamline log ingestion pipelines from parsing to normalization and enrichment
- Build scripts and automations (Python, PowerShell) to enhance SOC efficiency
- Integrate tools across the SOC stack to enable seamless workflows and response
- Collaborate with intel and IR teams to enrich detection use cases and support threat hunts
- Provide Tier 3+ support for incident investigations and post mortem analysis
- Improve SOC playbooks, SOPs, and detection engineering workflows
- Stay updated on global and regional threats and evolve detection accordingly
Requirements
- Bachelor's in Computer Science, Cybersecurity, or related field
- Hands on expertise in developing and maintaining complex detection use cases
- Strong understanding of attacker behavior, IR fundamentals, and digital forensics
- Expert in SIEM queries (SPL, KQL, Lucene), rule tuning, UEBA, and scaling
- Deep knowledge of EDR tools and endpoint detection tactics
- Proficient in packet analysis (Wireshark), IDS/IPS, and NetFlow
- Advanced skills in Python and/or PowerShell for automation and integration
- Mastery of Windows/Linux/macOS logging, artifacts, and forensic value
- Skilled in turning threat intel into real time detection logic
- Strong command of monitoring IaaS/PaaS/SaaS environments
- Excellent communication in English and Arabic
Full Job Posting
Role Overview
- As a Threat Detection Engineer at COGNNA, you'll design high impact detection strategies, build powerful automation, and elevate SOC operations to a world class standard.
- You'll also mentor rising cyber talent and collaborate with teams across threat intel, incident response, and platform engineering.
Advanced Threat Detection Engineering
- Build high fidelity correlation rules and behavioral detections within the COGNNA security platforms
- Translate adversary TTPs (MITRE ATT&CK), threat intel, and vulnerability data into actionable logic
- Identify detection gaps and introduce new data sources to cover evolving threat landscapes
- Automate detection testing and maintain detection quality over time
Platform Engineering & Optimization
- Lead architecture and optimization of XDR, SIEM, and SOC tech stacks for scale and resilience
- Streamline log ingestion pipelines — from parsing to normalization and enrichment
- Build scripts and automations (Python, PowerShell) to enhance SOC efficiency
- Integrate tools across the SOC stack to enable seamless workflows and response.
Threat Hunting & Incident Response
- Collaborate with intel and IR teams to enrich detection use cases and support threat hunts
- Provide Tier 3+ support for incident investigations and post mortem analysis
Mentorship & SOC Maturity
- Improve SOC playbooks, SOPs, and detection engineering workflows
- Stay updated on global and regional threats — and evolve detection accordingly
- Ensure compliance alignment (e.g., NCA ECC, SAMA CSF)
Education
- Bachelor's in Computer Science, Cybersecurity, or related field.
Experience
- Hands on expertise in developing and maintaining complex detection use cases
- Strong understanding of attacker behavior, IR fundamentals, and digital forensics.
Technical Skills (You're a Power User!)
- SIEM: Expert in SIEM queries (SPL, KQL, Lucene), rule tuning, UEBA, and scaling
- EDR: Deep knowledge of EDR tools and endpoint detection tactics
- Network Security: Pro at packet analysis (Wireshark), IDS/IPS, and NetFlow
- Scripting: Advanced skills in Python and/or PowerShell for automation and integration
- OS Internals: Mastery of Windows/Linux/macOS logging, artifacts, and forensic value
- Threat Intelligence: Skilled in turning threat intel into real time detection logic
- Cloud Security: Strong command of monitoring IaaS/PaaS/SaaS environments
Certifications (Highly Preferred)
- SANS GIAC (GDAT, GMON, GCIA, GCTI, GCIH)
- Offsec (OSDA)
- INE (eCTHP, eCIR)
- (ISC)² CISSP, CSSLP
Soft Skills
- Exceptional analytical thinking and creative problem solving
- Excellent communication (English & Arabic), including technical reporting
- Strong mentorship abilities and a collaborative spirit
- Self motivated, focused, and passionate about cyber defense
- Capable of juggling priorities under high pressure situations
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer
More jobs at COGNNA
Staff DFIR
Riyadh, KSA
Conduct end-to-end forensic investigations, lead DFIR teams, analyze logs, and automate workflows while ensuring compliance and effective communication.
Senior DFIR Guardian
Riyadh, KSA
Conduct end-to-end forensic investigations, analyze logs, automate evidence collection, and ensure compliance with cybersecurity regulations while communicating effectively in E...
Staff DFIR - COGNNA
Riyadh, KSA
COGNNA is seeking a Staff DFIR to lead end-to-end forensic investigations across endpoints, cloud, and network infrastructure. The role requires 5+ years in digital forensics and incident response, hands-on proficiency w
Staff DFIR - COGNNA
الرياض, KSA
COGNNA is seeking a Staff DFIR professional to lead forensic investigations and incident response. The role involves end-to-end investigations across endpoints, cloud, and network, coordinating the DFIR team, and buildin
Senior DFIR Guardian - COGNNA
الرياض, KSA
COGNNA is hiring a Senior DFIR Guardian to lead forensic investigations and incident response. The role involves end-to-end investigations, coordinating the DFIR team, and building AI-assisted workflows. Candidates need
Threat Detection - COOP
Riyadh, KSA
As a Threat Detection COOP at COGNNA, you ll design high-impact detection strategies, build powerful automation, and elevate SOC operations to a world-class standard. You ll als...
Threat Detection - COOP
Riyadh, KSA
COGNNA is offering a 6-month co-op for a Threat Detection COOP in Riyadh. You will design detection strategies, build automation, and support SOC operations while mentoring rising talent. Requires enrollment in a Bachelo
Threat Detection Engineer
Riyadh, KSA
As a Threat Detection Engineer at COGNNA, you ll design high-impact detection strategies, build powerful automation, and elevate SOC operations to a world-class standard. You ll...
Staff DFIR
Riyadh, KSA
Senior DFIR Guardian
Riyadh, KSA
Staff DFIR - COGNNA
Riyadh, KSA
Staff DFIR - COGNNA
الرياض, KSA
Senior DFIR Guardian - COGNNA
الرياض, KSA
Threat Detection - COOP
Riyadh, KSA
Threat Detection - COOP
Riyadh, KSA
Threat Detection Engineer
Riyadh, KSA