incident response analyst

DeepSource Technologies

<div>Position Overview
We are seeking a highly experienced Senior SOC Analyst &ndash; Layer 3 (DFIR) to lead advanced digital forensic investigations and incident response operations within our Cybersecurity Operations Center (SOC) in Jeddah.
The selected candidate will act as the highest technical escalation point for major security incidents, conduct in-depth forensic investigations, manage complex breach scenarios, and provide strategic guidance to SOC L1 and L2 teams. This role requires strong hands-on DFIR expertise in enterprise environments, including endpoint, network, cloud, and hybrid infrastructures.
Key Responsibilities
1. Advanced Incident Response Leadership<ul><li>Lead end-to-end handling of high-severity cybersecurity incidents (Ransomware, APT, data exfiltration, insider threats).</li><li>Direct containment, eradication, and recovery strategies during critical incidents.</li><li>Serve as primary escalation point for SOC L2 investigations.</li><li>Coordinate with IT, Legal, Risk, Compliance, and executive leadership during crisis situations.</li><li>Conduct post-incident reviews and lessons-learned workshops.</li></ul>
2. Digital Forensics Investigations<ul><li>Perform forensic acquisition and analysis of endpoints, servers, and cloud workloads.</li><li>Conduct disk, memory, and network forensics using industry-standard tools.</li><li>Preserve and maintain chain-of-custody documentation.</li><li>Analyze artifacts such as registry, event logs, browser history, persistence mechanisms, and lateral movement traces.</li><li>Prepare forensic reports suitable for executive and legal review.</li></ul>
3. Endpoint &amp; EDR Deep Analysis<ul><li>Perform deep investigations using enterprise EDR platforms such as</li></ul>
Microsoft Defender for Endpoint,
CrowdStrike Falcon, or equivalent.<ul><li>Conduct advanced threat hunting and behavioral analysis.</li><li>Reverse-engineer suspicious scripts or malware (basic to intermediate level).</li></ul>
4. SIEM &amp; Log Correlation Expertise<ul><li>Conduct advanced log analysis across SIEM platforms such as</li></ul>
Splunk Enterprise Security,
Microsoft Sentinel, or equivalent.<ul><li>Develop and optimize advanced detection queries (SPL / KQL).</li><li>Correlate endpoint, network, identity, and cloud telemetry for full attack chain reconstruction.</li><li>Map incidents to MITRE ATT&amp;CK framework techniques.</li></ul>
5. Network &amp; Cloud Forensics<ul><li>Analyze PCAP, NetFlow, DNS, proxy, and firewall logs.</li><li>Investigate suspicious lateral movement and command-and-control traffic.</li><li>Perform forensic investigations within Microsoft 365, Azure, and AWS environments.</li><li>Assess identity compromise scenarios (AD, Azure AD, privileged access abuse).</li></ul>
6. Threat Intelligence &amp; Proactive Defense<ul><li>Integrate threat intelligence feeds into DFIR investigations.</li><li>Conduct proactive threat hunting campaigns.</li><li>Participate in red team / purple team exercises.</li><li>Identify detection gaps and recommend defensive improvements.</li></ul>
7. Governance &amp; Compliance Support<ul><li>Ensure forensic readiness aligned with NCA ECC, SAMA CSF, ISO 27001, and other regulatory frameworks.</li><li>Maintain forensic documentation aligned with legal admissibility standards.</li><li>Contribute to incident response policy and playbook development.</li></ul>
8. On-Call &amp; Crisis Response<ul><li>Participate in 24x7 on-call rotation for major incidents.</li><li>Provide immediate response and executive-level briefing during critical cybersecurity events.</li></ul> 
Requirements 
Candidates must demonstrate proven, hands-on DFIR experience in:<ul><li>Minimum 7&ndash;10 years of experience in cybersecurity operations.</li><li>At least 3&ndash;5 years in L3 / DFIR role handling major enterprise incidents.</li><li>Practical experience with forensic tools such as:</li></ul>
o EnCase
o FTK
o X-Ways
o Volatility
o Autopsy<ul><li>Memory forensics and live response techniques.</li><li>Ransomware investigation and recovery coordination.</li><li>Advanced Windows &amp; Linux artifact analysis.</li><li>Network protocol deep understanding (TCP/IP, DNS, HTTP/S, SMB, LDAP, Kerberos).</li><li>Cloud security investigations (Azure / AWS / M365).</li><li>Evidence handling and chain-of-custody documentation.</li><li>Experience working in regulated sectors (Banking, Government, Critical Infrastructure preferred).</li></ul></div>

Senior SOC Analyst L3 - Saudi National - Jeddah, KSA

One Network

The requisition for a SOC Analyst experienced in FortiSIEM, FortiSOAR, and FortiXDR is required to support the Safe City Islamabad project, which operates a mission-critical and highly sensitive infrastructure. Continuous security monitoring, rapid incident response, and automated threat handling are essential to protect surveillance systems, networks, and operational data. A dedicated SOC resource will ensure timely detection and containment of cyber threats while maintaining service availability and strengthening the overall security posture.Analyst will be responsible for real-time security monitoring and alert analysis using SIEM, investigation and containment of threats through XDR, and execution of automated response playbooks in SOAR. The role includes incident triage, escalation, and coordination with internal teams to ensure timely remediation. The analyst will also assist in tuning security rules, onboarding log sources, and preparing incident and compliance reports to support secure operations.Actively monitor and analyze security events, alerts, and logs using SIEM, SOAR, EDR, Threat Intelligence and Cloud Security platforms.&middot; Investigate incidents to mitigate risks. Define and refine SOC automation workflows, including playbooks, alerts, reports, and dashboards, to improve threat detection and incident response.&middot; Tune SIEM correlation rules, policies, and alerts to reduce false positives and improve detection accuracy.&middot; Investigate security incidents such as malware infections, phishing attempts, lateral movement, privilege escalation, and data exfiltration.&middot; Coordinate with IT and security teams for incident containment, eradication, and recovery.&middot; Prepare detailed incident reports, root cause analysis (RCA), and post-incident documentation.&middot; Assist in onboarding new log sources and security devices into FortiSIEM.&middot; Support compliance and audit requirements (ISO 27001, SOC 2, PCI-DSS, etc.) by providing logs and incident evidence.&middot; Continuous Learning: Actively engage in continuous learning by staying informed about the latest cybersecurity threats, vulnerabilities, and industry best practices.<ul><li>&bull; NSE 5 / NSE 6, CEH or similar SOC/IR Certifications.</li></ul>BS in Computer Science, Information Security, Information Technology and relevant.Hands on Experience with FortiSIEM, SOAR and XDR.Job Type: Full-timePay: Rs130,000.00 - Rs170,000.00 per monthEducation:<ul><li>Bachelor's (Preferred)</li></ul>Experience:<ul><li>as Cyber Security Analyst	: 3 years (Preferred)</li></ul>License/Certification:<ul><li> NSE 5 / NSE 6, CEH or similar SOC/IR Certifications. (Preferred)</li></ul>Work Location: In person

Cyber Security Analyst

Quarterhill

<div><h2 class="jobSectionHeader">Job Description
</h2><div>Overview<div> 
The Junior Security Analyst is responsible for assessing, monitoring, and improving the organization&rsquo;s security posture, with a primary focus on incident detection, vulnerability management, response, and resolution across Quarterhill&rsquo;s Roadside, Back Office, Safety divisions.</div><div>
This role involves conducting vulnerability assessments, correlating security events, and guiding the organization&rsquo;s incident response efforts to prevent security breaches. In addition, this position will collaborate with cross-functional teams to enhance security awareness and integrate best practices across the enterprise. As a key contributor to the cybersecurity team, the Security Analyst works to ensure the organization is prepared for, and resilient against, evolving cyber threats.</div> 
<div></div>
 
Responsibilities 
Incident Detection and Response<ul><li>
Perform security event correlation using information from multiple sources to detect threats.</li><li>
Conduct cyber incident triage to assess scope, urgency, and impact.</li><li>
Respond, escalate, and resolve by enforcing security protocols and implementing solutions.</li><li>
Track cyber actions from initial detection through final resolution.</li><li>
Collaborate with internal IT teams and relevant stakeholders to develop and refine runbooks and escalation procedures.</li></ul>
Vulnerability Management<ul><li>
Maintain and update an inventory of all in-scope systems and software, ensuring it remains accurate and up to date.</li><li>
Reconcile data from multiple sources (e.g., CMDBs, network scans, asset management systems) to ensure inventory completeness.</li><li>
Ensure all in-scope systems and software are routinely scanned by the appropriate vulnerability management tools.</li><li>
Analyze and prioritize vulnerability scan results; open tickets, provide technical remediation guidance, and track resolution efforts to closure.</li></ul>
Analysis and Reporting<ul><li>
Conduct trend analysis and provide regular security performance reports.</li><li>
Operate with an awareness of applicable governance, risk, and compliance (GRC) regulations and policies.</li><li>
Utilize SIEM and other monitoring tools (e.g., Splunk, QRadar, Sentinel) to gather data for dashboards and executive summaries.</li></ul>
Policy Development and Training<ul><li>
Assist with the development and refining security protocols, policies, and incident response plans.</li><li>
Assist in the development of employee training programs to enhance organizational cybersecurity awareness.</li></ul>
Post-Incident Analysis<ul><li>
Assess and analyze damage to data and infrastructure.</li>
Provide post-incident reports to management, including root cause analysis and recommendations for prevention. 
<li>
</li></ul> 
Qualifications 
Education and Experience<ul><li>
Bachelor&rsquo;s degree in a computer-related field, cybersecurity, or equivalent experience (including military experience, such as communications or cyber-MOS).</li><li>
Minimum of 1+ year in a cybersecurity role.</li><li>
Experience with Windows and Linux operating systems and database security.</li></ul>
Certifications (Required)<ul><li>
Security+ (CompTIA</li></ul> 
Preferred Certifications (Optional)<ul><li>
CYSA+ (CompTIA Cybersecurity Analyst).</li><li>
Additional relevant certifications (e.g., CEH, GSEC, GCIA) are a plus.</li></ul>
Skills and Knowledge<ul><li>
Working knowledge of current commercial off-the-shelf (COTS) cybersecurity technologies and trends to include SIEM, EDR, and vulnerability management.</li><li>
Familiarity with cybersecurity operations center (SOC) environments.</li><li>
Knowledge of security principles, techniques, and incident response frameworks (e.g., NIST, MITRE ATT&amp;CK).</li><li>
Strong analytical skills for identifying and mitigating threats.</li><li>
Ability to operate effectively in high-pressure environments with shifting priorities.</li><li>
Scripting or automation skills (e.g., Python, PowerShell) and experience with SIEM log queries are highly desirable.</li></ul>
Preferred Qualifications
Hands-On SOC or CSIRT Experience<ul><li>
Experience working in a cybersecurity operations center (SOC) or computer security incident response team (CSIRT) environment.</li><li>
Familiarity with EDR, XDR, or threat-hunting tools.</li></ul>
Project and Time Management<ul><li>
Ability to manage multiple tasks simultaneously, with effective prioritization and communication with senior management.</li><li>
Proven track record of delivering security improvements and initiatives on schedule.</li></ul>
Cybersecurity Engineering Familiarity<ul><li>
Familiarity with tools and technologies used in cybersecurity engineering.</li><li>
Comfortable working with cloud platforms (AWS, Azure, GCP), container security, and DevSecOps practices.</li></ul>
Soft Skills<ul><li>
Strong communication skills to articulate technical concepts to both technical and non-technical audiences.</li><li>
Team-oriented mindset, with a willingness to collaborate across departments to drive a culture of security.</li></ul>
 
Benefits 
We offer a Total Rewards plan designed with you and your family&rsquo;s health and wellness in mind that includes:<ul><li>
Paid days off (i.e. vacation, sick days, bereavement leave)</li><li>
Health and Dental plans</li><li>
Retirement plans</li><li>
Employee and Family Assistance Program (EFAP)</li><li>
Employee referral program</li><li>
Employee Stock Purchase Program (ESPP)</li></ul><div></div><div> 
We welcome applicants from all backgrounds, regardless of race, color, religion, sex, veteran status, sexual orientation, gender identity, national origin, age, or disability or any other protected characteristics in accordance with applicable federal, state/provincial, and local laws. We're committed to creating a workplace where everyone feels valued and respected.</div><div></div> 
We appreciate all responses and will acknowledge only those being considered for an interview.
We respectfully request no calls or unsolicited resumes from Agencies.</div></div>

Junior Security Analyst

Al Adyat consultancy

Job Summary: The SOC Analyst Level 1 is responsible for monitoring, detecting, and responding to security events and incidents within the organization. The role involves analyzing alerts from various security tools, escalating incidents when necessary, and maintaining documentation of security activities. This is an entry-level position for candidates looking to start a career in cybersecurity.Key Responsibilities:<ul><li>Monitor security alerts and events from SIEM (Security Information and Event Management) and other security tools.</li><li>Perform initial triage and analysis of security incidents.</li><li>Escalate confirmed incidents to Level 2 or appropriate teams.</li><li>Maintain accurate incident documentation and logs.</li><li>Assist in vulnerability management and routine security checks.</li><li>Follow standard operating procedures (SOPs) for incident response.</li><li>Stay updated on the latest cybersecurity threats and trends.</li></ul>Qualifications:<ul><li>Bachelor&rsquo;s degree in Computer Science, Information Technology, Cybersecurity, or a related field.</li><li>Basic understanding of networking, firewalls, intrusion detection/prevention systems, and endpoint security.</li><li>Familiarity with SIEM tools such as Splunk, QRadar, or ArcSight is a plus.</li><li>Strong analytical and problem-solving skills.</li><li>Good communication skills, both written and verbal.</li><li>Willingness to work in shifts (if SOC operates 24/7).</li></ul>Preferred Certifications (Optional):<ul><li>CompTIA Security+</li><li>Cisco CCNA Security</li><li>EC-Council CEH (Certified Ethical Hacker)</li></ul>Working Conditions:<ul><li>Shift-based work depending on SOC operational hours.</li><li>Fast-paced environment requiring attention to detail and quick response to incidents.</li></ul>Career Path: Successful SOC Analyst L1 can progress to SOC Analyst L2, then to SOC Analyst L3, Threat Hunter, or Incident Response Specialist roles.Job Type: Full-timePay: QAR10,000.00 - QAR13,000.00 per monthEducation:<ul><li>Bachelor's (Required)</li></ul>Experience:<ul><li>SOC Analyst Level 1 (L1): 3 years (Required)</li></ul>Language:<ul><li>Arabic (Required)</li><li>English (Required)</li></ul>License/Certification:<ul><li>degree in Computer Science, Information Technology (Required)</li></ul>Location:<ul><li>Doha (Required)</li></ul>

SOC Analyst Level 1 (L1)

American International University, Kuwait

<div>
 
 
 Cyber Security Analyst
 
 
 
 
 
 
 This position is only open to candidates already residing in Kuwait.
 
 
 
 
 
 
 Job Summary
 
 
 
 The Cybersecurity Analyst monitors security systems, investigates incidents, and supports vulnerability management to strengthen the university&rsquo;s cybersecurity posture.
 
 
 
 
 
 
 Key Responsibilities
 
 
 <ul>
 <li>
 Monitor and analyze security alerts across networks, systems, endpoints, and email platforms.
 </li>
 <li>
 Investigate and respond to security incidents including phishing, malware, and unauthorized access.
 </li>
 <li>
 Conduct threat hunting and analyze indicators of compromise using threat intelligence and MITRE ATT&amp;CK.
 </li>
 <li>
 Manage and respond to alerts from cybersecurity tools such as endpoint protection, email security, and DLP systems.
 </li>
 <li>
 Perform vulnerability assessments and support penetration testing remediation.
 </li>
 <li>
 Enforce access controls and security policies across systems and security platforms.
 </li>
 <li>
 Maintain incident documentation and support cybersecurity awareness initiatives.
 </li>
 <li>
 Collaborate with IT teams and provide basic network monitoring and operational support.
 </li>
 </ul>
 
 
 
 
 
 Skills and Competencies
 
 
 <ul>
 <li>
 2&ndash;3 years of experience in cybersecurity operations, SOC, or incident response roles.
 </li>
 <li>
 Experience with endpoint security tools such as SentinelOne or ESET.
 </li>
 <li>
 Familiarity with email security platforms such as Barracuda and phishing simulation tools.
 </li>
 <li>
 Experience with vulnerability assessments and supporting penetration testing activities.
 </li>
 <li>
 Knowledge of incident response processes, threat hunting techniques, and MITRE ATT&amp;CK.
 </li>
 <li>
 Understanding of DLP systems, access controls, and security monitoring environments.
 </li>
 <li>
 Strong analytical, documentation, and problem-solving skills with the ability to collaborate across IT teams.
 </li>
 </ul>
 
 
 
 
 
 Educational Qualifications &amp; Certifications
 
 
 <ul>
 <li>
 Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related field.
 </li>
 <li>
 Certifications such as CompTIA Security+, Fortinet NSE, Cyware Certified Orchestrate Analyst, or similar are preferred.
 </li>
 <li>
 Additional certifications in SOC operations, threat intelligence, penetration testing, or SIEM platforms are considered an advantage.
 </li>
 </ul>
 
 
 
 
 
 About American International University
 
 
 
 American International University (AIU) is a private university in Kuwait founded in 2019 offering undergraduate programs in Engineering, Architecture and Design, and Business Administration based on the American higher education model. AIU is committed to preparing graduates for leadership roles in a global society.
 
</div>

Cyber Security Analyst (local candidates only)

Lumifi Cyber

<div>L2 Security Analyst- Night Shift
Full-Time, on-site 
All night shift earn a 10% salary differential pay.
We are looking for a Senior Security Analyst (L2) to join the Lumifi Cyber SOC team for the night shift. Senior Security Analysts are expected to handle customer facing investigations, mentoring, and training of fellow analysts, and to participate in interaction with customers and other teams through email or phone.
Primary Duties:<ul><li>
Triage alerts and determine if further investigation or action is required by the customer</li><li>
Assist customers with the investigation and response of incidents throughout the incident response process</li><li>
Perform investigations of customer requests and be able to provide further contextual information along with recommended actions</li><li>
Proactively threat hunt using network and host data within customer environments</li><li>
Mentor junior analysts</li></ul>
Required Qualifications:<ul><li>
Ability to analyze packet captures/data and logs to perform incident response and identify potential compromises to customer networks</li><li>
Possesses a solid understanding of the TCP/IP protocol suite, security architecture, and common TTP&rsquo;s (tactics, techniques, and procedures) used by threat actors</li><li>
Experience analyzing both log and packet data in a SIEM (RSA NetWitness, Azure Sentinel, Splunk, etc.)</li><li>
Strong understanding of incident response methodologies and reporting</li><li>
Experience using ticketing systems for tracking (JIRA, Remedy, ServiceNow, etc.)</li><li>
Strong verbal/written communication and interpersonal skills are required to document and communicate findings, escalate critical incidents, and interact with customers</li></ul>
Preferred Qualifications:<ul><li>
Minimum of 3+ years of experience performing triage/incident response in enterprise environments
</li><li>Minimum of 3+ years of experience performing forensic analysis of logs and packet captures to identify malicious artifacts</li><li>
Higher level security certifications (CEH, GCIH, GCFA, GCFE, GCTI, GCIA, GREM, GPEN, GFNA, OCSP)</li><li>
Strong research background and an analytical approach, especially with respect to event classification, event correlation, and root cause analysis</li><li>
A mentoring/leadership background including mentoring other analysts and orchestrating team efforts for problem solving</li><li>
Ability to manage projects to completion both individually and in a group</li></ul>
Benefits Include:<ul><li>
Recharge in Style: Need some downtime? We've got your back with self-managed time off to rest, recharge</li><li>
Great Healthcare Coverage: Your well-being is a priority for us. That's why we offer exceptional healthcare coverage to keep you in tip-top shape with 80% employer coverage.</li><li>
Holistic Well-Being: We're not just about the basics. Dive into our holistic well-being programs that cover everything from family planning to much, much more.</li><li>
Fully Stocked Snack Bar for our onsite team</li><li>
Comprehensive Professional Development Benefits: Regular training sessions and workshops, personalized career coaching, opportunities for conferences and seminars, and access to leading online learning platforms for self-paced skill development.</li></ul>
All candidates must be eligible to work in the U.S. for any employer. We are an E-Verify employer.
Lumifi welcomes and encourages diversity in our workplace. All qualified applicants will receive consideration for employment without regard to race color, religion, sex, sexual orientation, gender identity, national origin or disability.
IvjFGys71m</div>

Senior Security Analyst - Nights (onsite)

PRTC

<div>Position Summary 

PRTC is seeking a Cybersecurity Analyst to support the cooperative&rsquo;s security operations, incident response capabilities, and continuous improvement of the organization&rsquo;s cybersecurity posture.
 
This position will be responsible for monitoring cybersecurity activity, coordinating incident response efforts, and identifying risks across the organization&rsquo;s infrastructure. The analyst will work across endpoint security, network security, vulnerability management, identity monitoring, and data protection controls.
 
 
In addition to strengthening PRTC&rsquo;s internal cybersecurity program, this role will contribute to the development of cybersecurity services that can be delivered to cooperative members and business customers through PRTC&rsquo;s managed services offerings.
 
 
The ideal candidate is a hands-on security professional who can analyze security events, investigate suspicious activity, and translate findings into meaningful improvements to the organization&rsquo;s security posture.
 
Essential Job Functions:
 
Incident Response:  
Serve as the primary point of contact for security incident response activities.  
Coordinate early-stage response efforts and escalate incidents to appropriate personnel when necessary.  
Document investigative findings throughout the life cycle of an incident, and recommend improvements to prevent recurrence.  
Maintain and improve incident response procedures and documentation.
 
Security Monitoring &amp; Threat Detection:  
Monitor, analyze and respond to security events across all endpoints in the network through our SOC, EDR, SIEM and internal logging systems.  
Validate that security telemetry and logging sources are functioning properly and providing adequate visibility daily.
 
Email Security &amp; Phishing Response:  
Review user-reported phishing submissions and suspicious email activity.  
Investigate potential phishing incidents and coordinate remediation actions.  
Support user awareness training and suggest security improvement initiatives related to phishing and social engineering threats.
 
Network Security:  
Review network access control policies and security rules set by PRTC. Suggest changes or additions that could protect PRTC&rsquo;s data further.
 
Vulnerability Management:  
Coordinate and assist in vulnerability assessment activities across organizational systems.  
Review vulnerability findings and suggest prioritization of remediation efforts.  
Produce reports and track remediation progress with relevant teams.  
Possess the ability to develop design specifications, technical requirements, technical diagrams and documentation needed to ensure successful data protection.  
Support protection of Customer Proprietary Network Information (CPNI) and other sensitive organizational data.
 
AI Security &amp; Emerging Technology:  
Review internal usage of artificial intelligence technologies for potential security risks or data exposure.  
Assess current security policies and organizational controls to ensure they address emerging threats associated with AI adoption.
 
Security Governance &amp; Continuous Improvement: &bull; 
Maintain documentation related to security processes and change management activities. &bull; 
Review company policies to ensure compliance with security standards and practices. 
Knowledge, Skills, and Abilities:

 3+ years of experience in cybersecurity, security operations, or a related technical field. 
 Experience investigating security alerts, suspicious activity, and incident response scenarios. 
 Strong understanding of network protocols, system hardening, authentication, and modern attack techniques and tool sets used for those attacks. 
 Experience working with security monitoring platforms, vulnerability management processes, and endpoint protection technologies. 
 Familiarity with NIST CSF, ISO 27001, PCI-DSS, and MITRE ATT&amp;CK frameworks. 
 Ability to clearly document technical findings and communicate security risks to both technical teams and leadership. 
 Experience securing hybrid infrastructure environments, including cloud and on-premises systems.

Education and Experience: 
 Current industry certifications such as CISSP, GIAC, Security+, SecurityX, CySA+, CCSP, or similar are preferred. 

Education and Experience:
<ul>
<li>Current industry certifications such as CISSP, GIAC, Security+, SecurityX, CySA+, CCSP, or similar are preferred.</li></ul></div>

Cybersecurity Analyst

Search 10000+ Incident response analyst jobs near you this March. New roles added regularly across leading industries. Apply today.