threat hunter

Technology Control Company | شركة تحكم التقنية

<div>
 
 
 Key Responsibilities:
 
 
 
 
 
 <ul>
 <li>
 Collect and verify raw intelligence from multiple strategic and tactical data sources and correlate collected intelligence to build upon a larger knowledge.
 </li>
 <li>
 Research threats, vulnerabilities, and intelligence on various attackers and attack infrastructure using internal and external resources.
 </li>
 <li>
 Automate tracking and discovery of threats leveraging internal and external data sources.
 </li>
 <li>
 Contribute to the production of reports detailing threat groups including TTPs.
 </li>
 <li>
 Analyze logs and perform log correlations to identify anomalous/malicious behavior utilizing.
 </li>
 <li>
 Responding to prioritized requests for information (RFI) and provide key findings to enable the production of finished intelligence.
 </li>
 <li>
 Develop Attack detection response playbooks, counter-measure definition, and strategies to mitigate emerging threats.
 </li>
 <li>
 Develop use cases mapped to common frameworks (e.g., MITRE ATT&amp;CK) for detecting new/evolving threats, including supporting content for security tools (e.g., SIEM rules, NIDS signatures, EDR content, etc.).
 </li>
 <li>
 Plan and execute regular simulation attack exercises (red-team/blue-team / purple-team) to validate detection, response, and remediation capabilities and improve MSOC readiness.
 </li>
 </ul>
 
 
 
 
 
 Qualifications:
 
 
 <ul>
 <li>
 Bachelor of Computer Science or equivalent
 </li>
 </ul>
 
 
 Professional Certifications:
 
 
 <ul>
 <li>
 Professional certification in pen testing from internationally recognized institution or relevant are preferred.
 </li>
 </ul>
 
 
 Years of Experience:
 
 
 <ul>
 <li>
 6+ years of prior experience
 </li>
 </ul>
 
 
 Nature of Experience:
 
 
 <ul>
 <li>
 2 years in security operation and threat hunting and 2 years in threat intelligence
 </li>
 </ul>
 
 
 Job Specific Skills:
 
 
 <ul>
 <li>
 Practical experience in Identifying and investigating information security incidents and developing recommendations to prevent similar incidents in the future.
 </li>
 <li>
 Understanding of the methods, tools, and processes to respond to information security incidents.
 </li>
 </ul>
 
 
</div>

Principle SOC Research Consultant

techzone technologies llc

We Are Hiring: Senior SOC Engineer / Digital Forensics &amp; Incident Response (DFIR)Join our Cyber Security team at Etisalat UAE &ndash; Head Office, Dubai.We are looking for a highly skilled cybersecurity professional with strong expertise in digital forensics, incident response, threat hunting, and security operations to protect and defend our digital infrastructure against advanced threats.Key ResponsibilitiesThreat Monitoring &amp; Incident Response<ul><li>Monitor security alerts across SIEM, EDR, IDS/IPS, and network security tools.</li><li>Perform full lifecycle incident response: detection, containment, eradication, and recovery.</li><li>Lead forensic investigations for cyber incidents including APTs, ransomware, and insider threats.</li></ul>Digital Forensics &amp; Evidence Handling<ul><li>Conduct host, network, and mobile forensics across Windows, Linux, macOS, and mobile platforms.</li><li>Utilize advanced forensic tools (EnCase, FTK, Cellebrite, Oxygen, Volatility).</li><li>Ensure proper chain of custody and documentation aligned with regulatory standards.</li></ul>Threat Hunting &amp; Intelligence<ul><li>Perform proactive threat hunting based on IOCs, TTPs, and behavioral analysis.</li><li>Analyze global threat intelligence feeds and track emerging cyber risks.</li><li>Develop custom hunting queries using KQL and enhance detection rules.</li></ul>Cloud Security &amp; IR<ul><li>Lead cloud incident response and forensics across AWS &amp; Azure environments.</li><li>Investigate cloud logs, identity events, workload activities, and anomalous behaviors.</li></ul>Automation &amp; Advanced Analysis<ul><li>Use Python/PowerShell scripts to automate investigation and response tasks.</li><li>Conduct initial malware analysis and assess potential impact.</li></ul>Reporting &amp; Documentation<ul><li>Produce detailed incident reports, forensic summaries, and threat-hunting findings.</li><li>Present technical insights clearly to both technical and non-technical stakeholders.</li></ul>Qualifications<ul><li>Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Security, or related field.</li><li>6&ndash;8 years of experience in SOC, DFIR, Threat Hunting, or Cyber Incident Response.</li><li>Strong experience with SIEM (Splunk, Sentinel), EDR, packet analysis, and log forensics.</li><li>Mandatory DFIR certifications (GCFA, GCIH, GCFE, or equivalent preferred).</li><li>Strong scripting skills (Python, PowerShell) and familiarity with MITRE ATT&amp;CK.</li><li>Excellent analytical skills, attention to detail, and ability to work under pressure.</li><li>Fluent in English.</li></ul>Job Type: Full-timePay: AED18,000.00 - AED22,000.00 per monthApplication Question(s):<ul><li>Do you have hands-on experience in Digital Forensics &amp; Incident Response (DFIR), including host forensics, memory analysis, network forensics, and incident handling?</li></ul>(Please mention the tools you use such as EnCase, FTK, Cellebrite, Volatility, Splunk, Sentinel, etc.)<ul><li>Have you previously worked in a SOC environment with threat hunting responsibilities?</li></ul>(Kindly share your experience with SIEM, EDR, IDS/IPS, and cloud IR on AWS/Azure.)<ul><li>Do you hold any cybersecurity certifications such as GCFA, GCIH, GCFE, OSCP, or similar?</li></ul>(Please list all relevant certifications.)<ul><li>What is your expected salary, age, notice period, and current location?</li></ul>

Senior Soc Engineer/ Digital Forensics & Incident Response

DTS Solution

Role and Responsibilities 
 
 <div>
 <div>
 <ul>
 <li>
 
 Work as a DFIR consultant in DTS Solution supporting our 800-HACKED program </li>
 <li>
 
 Work as a consultant for many Incident Retainer Program </li>
 <li>
 
 Cyber breach investigations including forensic and malware analysis. Identifies network computer intrusion evidence and perpetrators. </li>
 <li>
 
 Strong understanding on threat hunting methodologies. </li>
 <li>
 
 Strong experience in post-compromise assessment. </li>
 <li>
 
 Ability to perform detailed forensics investigations; </li>
 <li>
 
 Knowledge on DFIR tools Autospy, Encase, Access Data, FTK+, IDA etc. </li>
 <li>
 
 Examines and performs comprehensive technical analysis of computer-related evidence and information stored on a device(s) during the conduct of an investigation or litigation. </li>
 <li>
 
 Proactively advise teams/hunt for and research potential malicious activity and incidents across multiple platforms using advanced threat network and host-based tools. </li>
 <li>
 
 Use both internal and external threat intelligence to build indicators of compromise into monitoring tools, can integrate these tools with one another to provide data enrichment. </li>
 <li>
 
 Use strong TCP/IP networking skills to perform network analysis to isolate and diagnose potential threats and anomalous network behavior. </li>
 <li>
 
 Ensures chain of custody and control procedures, documents procedures and findings in a manner suitable for courtroom presentation and prepares comprehensive written notes and reports. </li>
 <li>
 
 Report common and repeated problems (trend analysis) to management and propose process and technical improvements. </li>
 <li>
 
 Provide resolution plans for system and network issues. </li>
 <li>
 
 Provide support in the detection, response, mitigation, and reporting of real or potential cyber threats to the environment and assist in the automation of the processes. </li>
 <li>
 
 Provides oral and written communication to staff personnel concerning findings of fact, results of examination(s), and legal declarations, and testify in court as to the procedures and methodology used to recover and identify relevant evidence. </li>
 <li>
 
 Ability to write Incident Response Reports in accordance to international standards. </li>
 </ul>
 </div>
 </div>
 <div>
 <div>
 <div>
</div>
 </div>
 </div>
 <div>
 <div>
 Qualifications </div>
 </div>
 <div>
 <div>
 <ul>
 <li>
 
 6+ years of experience of network/security and analyzing digital evidence and investigate computer security incidents </li>
 <li>
 
 Expert knowledge on DFIR tools such as Access Data, IDA Pro, FTK+, Encase </li>
 <li>
 
 Expert knowledge on threat hunting tools commercial and open source </li>
 <li>
 
 Familiarity with network tools such as Wireshark, tcpdump, libpcap. </li>
 </ul>
 </div>
 </div>
 <div>
 <div>
 <div>
</div>
 </div>
 </div>
 <div>
 <div>
 Certifications </div>
 </div>
 <div>
 <div>
 <ul>
 <li>
 
 GCIA, GCIH, or CISSP Certifications </li>
 <li>
 
 SANS Certified Forensic Examiner (GCFE) </li>
 <li>
 
 Forensic/ Incident Response Professional </li>
 <li>
 
 Industry Certification on Digital Forensics Tool </li>
 </ul>
 </div>
 </div>
 
 
 <div>
 <div>
<div>
 <div>
 <div>
 <div>
 <div> </div></div><div>
 </div>
 <div>
 <div>
 <div></div></div></div></div></div></div></div></div>

Digital Forensics and Incident Response Consultant

Binance

<div>
 <div>
 Responsibilities
 <ul>
 <li>Design, deploy, and optimize DLP solutions across network, endpoint, and cloud.</li>
 <li>Build and refine data classification schemes for sensitive assets (wallets, trading algorithms, customer PII).</li>
 <li>Configure DLP policies to prevent data exfiltration while minimizing false positives.</li>
 <li>Monitor, analyze, and tune alerts and incidents for continuous improvement.</li>
 <li>Lead investigations of DLP incidents and insider threats,</li>
 <li>Conduct threat hunting and forensic analysis of data exfiltration attempts.</li>
 <li>Integrate DLP monitoring into broader SOC workflows and incident response playbooks.</li>
 <li>Build custom DLP tools and integrations (e.g., macOS Swift endpoint protection, Unix socket monitoring).</li>
 <li>Develop automation scripts, APIs, regexes and integrations to enhance detection and response.</li>
 <li>Explore AI/LLM-driven methods for anomaly detection and response efficiency.</li>
 <li>Ensure controls align with crypto and financial regulations (AML, KYC, GDPR, CCPA).</li>
 <li>Support audits and regulatory reviews related to data protection.</li>
 <li>Assess and mitigate data loss risks across trading platforms, onboarding systems, and blockchain infrastructure.</li>
 </ul>
 </div>
</div>

DLP & Incident Response Engineer

XiFin

<div>Are you interested in harnessing technology and AI to transform healthcare?
 At XiFin, we believe a healthier, more efficient healthcare system starts with strong financial and operational foundations. Our innovative technologies help diagnostic providers, laboratories, and healthcare systems manage complexity, drive better outcomes, and stay focused on what matters most: patient care.
We&rsquo;re on a mission to simplify the business side of healthcare&mdash;and we know that mission takes people from all backgrounds and experiences. Whether you&rsquo;re early in your career or bringing years of expertise, we welcome your perspective, your curiosity, and your passion. We value individuals who ask questions, challenge the status quo, and want to grow while making a real difference.
About the Role
The Cyber Security Analyst will analyze, evaluate, and tune SIEM events and alerts, threat hunting, automating investigation tasks, and conducting incident response when a security incident arises. Focus on identifying, researching, and performing offensive cyber security tactics and techniques to test and verify preventative and detective security controls.
Work as a key member on project teams to ensure security by design principles are implemented in every IT and development effort, to ensure the effective and appropriate use of security technology solutions and processes that reduce risk and increase the security of the company and its data. Build relationships and partner across the organization and work with team members inside and outside of the department.
How you will make an impact:<ul><li>
Conducting incident response investigations from escalated incidents across Windows and Linux systems, and supporting all phases of the incident response process.</li><li>
Developing, documenting, and testing incident response playbooks and runbooks;</li><li>
Performing cybersecurity forensic analysis, including artifact collection, malware analysis, and timeline reconstruction;</li><li>
Assessing and prioritizing vulnerabilities based on risk factors and exploitability, coordinating remediation efforts, and investigating potential signs of compromise;</li><li>
Understanding and evaluating emerging threats on cyber security exploits, vulnerabilities, tactics, and techniques;</li><li>
Developing detection logic across SIEM environments using the ADS framework and mapping detections to MITRE ATT&amp;CK;</li><li>
Analyzing and tuning SIEM alerts, operating system logs, and security events to improve detection capabilities;</li><li>
Participating in and conducting threat hunting and threat assessment in the context of information technology architecture;</li><li>
Utilizing offensive security tools, including Breach and Attack Simulation (BAS) solutions, to enhance detection capabilities and identify gaps in the organization's defenses;</li><li>
Designing, documenting, validating, and testing security hardening configurations in line with CIS Benchmarks and organizational standards;</li><li>
Conducting software risk assessments for desktop applications and browser extensions to identify potential security concerns and ensure compliance with organizational policies;</li><li>
Evaluating and testing enterprise security controls deployed in multiple IT infrastructure environments;</li><li>
Automating incident response tasks and other processes using scripting languages like PowerShell, Python, and Bash;</li></ul>
What you will bring to the team:
We&rsquo;re looking for someone with a growth mindset and a passion for consultative selling. You might be a great fit if you:<ul><li>
Are highly analytical, organized, and proactive in solving challenges</li><li>
Communicate clearly and confidently, translating technical concepts for diverse audiences</li><li>
Thrive in dynamic environments and adapt quickly to changing client needs</li><li>
Build strong relationships and influence decision-makers at all levels</li><li>
Demonstrate a commitment to continuous learning.</li></ul>
Skills and experience you have:
You don&rsquo;t need to check every box. We will consider a combination of education and experience, including:
The position requires a proactive individual who independently seeks and consumes cyber security knowledge to improve the security posture of the program. The ideal candidate must think calmly yet quickly during stressful cyber security incidents, effectively communicating with peers and management and possess the ability to evaluate suggestions, assess risks, and implement innovative solutions while ensuring compliance with standards and regulations.
The position requires a proactive individual who independently seeks and consumes cyber security knowledge to improve the security posture of the program. The ideal candidate must think calmly yet quickly during stressful cyber security incidents, effectively communicating with peers and management and possess the ability to evaluate suggestions, assess risks, and implement innovative solutions while ensuring compliance with standards and regulations.<ul><li>
BS in Computer Science, Engineering or a closely related field and 5 years of related experience in Cyber Security Incident Response</li><li>
Ability to secure operating systems including Windows and Linux;</li><li>
Ability to produce detailed incident timelines and investigation reports;</li><li>
Practical experience in digital forensics as part of incident response efforts;</li><li>
Requires excellent verbal, written communication and ability to interact professionally within a corporate environment;</li><li>
Ability to manage multiple assignments and track through to completion;</li></ul>
Pay Transparency
At XiFin, we believe in pay transparency and fairness. The expected annual salary for this role is $139,485, based on your experience, skills, and geographic location.
Depending on your qualifications, final compensation will be determined during the selection process and may vary accordingly.
Accessibility &amp; Accommodations
We&rsquo;re committed to providing an inclusive and accessible experience for all applicants. If you need a reasonable accommodation during the application process, please contact us at 858-436-2901.
Equal Opportunity Employer
XiFin is proud to be an equal opportunity employer. We value diverse voices and do not discriminate on the basis of race, color, religion, national origin, gender, gender identity, sexual orientation, disability, age, veteran status or any other basis protected by law.
Ready to apply? 
We&rsquo;d love to hear from you&mdash;even if you&rsquo;re not sure you meet every qualification. If you're excited about the role and believe you can contribute to our team, please apply. Let's build something meaningful together.</div>

Cyber Security Analyst

FIN Hospitality

Job Profile: Cyber Security Operations Center (SOC) Analyst (Mid&ndash;Senior Level)Location: Doha, QatarAvailability: Starting January 26 Employment Type: Full-timeTarget Salary Range (total package): 25k to 30kMandatory Requirements<ul><li>Experience: Minimum 4&ndash;7 years of experience as a SOC Analyst or in a related cybersecurity role (mid to senior level)</li><li>Language: Fluent in English (written and spoken)</li><li>Availability: Ready to join by January 26</li><li>License: Valid driving license</li><li>Strong hands-on attitude with systems and security tools, including configuration, troubleshooting, and optimization</li><li>In-depth understanding of security frameworks (MITRE ATT&amp;CK, NIST, ISO 27001, etc.)</li><li>Proficiency with SIEM tools such as Sentinel, Splunk, or QRadara</li></ul>Preferred Qualifications (Plus Points)<ul><li>Arabic speaker</li><li>Experience in the Oil &amp; Gas sector, particularly in industrial control systems (ICS) or OT security</li><li>Relevant certifications such as GCIA, GCIH, CEH, CompTIA Security+, or CISSP</li></ul>Key Responsibilities<ul><li>Monitor, analyze, and respond to security alerts from various systems and tools (SIEM, IDS/IPS, firewalls, endpoint protection, etc.)</li><li>Investigate and triage security incidents, identifying root causes and implementing corrective actions</li><li>Conduct threat hunting and vulnerability assessments to identify potential risks</li><li>Develop and maintain incident response procedures and playbooks</li><li>Collaborate with IT and network teams to improve security posture and incident response readiness</li></ul>Job Types: Full-time, PermanentPay: QAR25,000.00 - QAR30,000.00 per month

SOC (cyber security operation center) analyst (Mid–Senior Level)

QBE Management Services (UK) Limited

Primary Details Time Type: Full time Worker Type: Employee SOC Principal Analyst Permanent London/ Hybrid At QBE, our purpose is to enable a more resilient future. We are an international insurer and reinsurer with a local presence in 27 countries. The Opportunity QBE Europe is currently recruiting a SOC Principal Analyst to join our cyber security team in our London Office. Reporting to regional team leads, the SOC Principal Analyst will be a key member of our rapidly growing Global Security Operations team. Your new role This is an exciting hands-on technical role in which the specialist will use their security skills and knowledge to perform advanced analysis on the collection of cyber threats using high-level proactive and reactive threat hunting methods, classifying, analysing, prioritising and remediating security alerts/events. The focus is to provide effective, proactive and a highly technical analytical response to cyber security-related incidents to prevent QBE from becoming compromised by modern attack methods and techniques. Main responsibilities: <ul> <li> Act as point of escalation and mentor to junior SOC analysts. </li></ul> <ul> <li> Translates business objectives into security objectives by providing support in design/architecture for new security applications to improve the current security posture globally for QBE. </li></ul> <ul> <li> Recommends and implements initiatives, develops IR processes and procedures. </li></ul> <ul> <li> Contribute to the ongoing development of security operations "best practice" and support continuous improvement. </li></ul> <ul> <li> Provide guidance regarding security technical support, and influence peers in following best practice. </li></ul> <ul> <li> Review new security products and ascertain their suitability for the QBE environment. </li></ul> <ul> <li> Execute threat hunting activities using various proprietary and open source tools to identify current and emerging threats that pose a risk to QBE. </li></ul> <ul> <li> Build strong relationships with internal and external stakeholders to maintain and improve QBE security and enhance knowledge and information sharing. </li></ul> <ul> <li> Actively communicate with staff and third parties to correctly identify and resolve problems and manage their expectations. </li></ul> <ul> <li> Document incidents, requests and problem management information to ensure required compliance standards/SLAs are achieved. </li></ul> <ul> <li> Use security tools and resources to correlate suspicious events, providing context around the event, determine root cause and provide regular updates and recommend modifications to existing systems and procedures. </li></ul> <ul> <li> Perform deep-dive incident analysis of various data sources by analysing and investigating security related logs against medium-term threats and IOCs </li></ul> <ul> <li> Actively manage and apply the phases of Incident Response (preparation, identification, containment, eradication, recovery and lessons learned) </li></ul> <ul> <li> Act as a point of reference to guide and advise others to ensure the sharing of knowledge and best practice throughout the team. </li></ul> About you <ul> <li> Advanced technical expertise of security solutions and technologies, including: Windows, Linux, Networking, Security Architecture experience and knowledge of packet flow/TCP/UDP traffic, Firewall and proxy technologies, cloud solutions, anti-virus, static and dynamic malware analysis techniques </li></ul> <ul> <li> Expert in performing analytics with different types of logs, i.e. network, active directory, database, DNS, firewall, proxies, host-based security, cloud and applications logs etc. </li></ul> <ul> <li> Working experience in leading security incidents at all levels related to incident response </li></ul> <ul> <li> Working experience in managing 2nd/3rd level security events </li></ul> <ul> <li> Ability to manage strong relationships with global security operations colleagues and other departments, including network teams and incident managers. </li></ul> <ul> <li> Demonstrated ability to make decisions on remediation and counter measures </li></ul> <ul> <li> Be able to communicate effectively and update senior stakeholders globally </li></ul> Why QBE? At My Best? ?At QBE, we want our people to feel rewarded and inspired to perform at their best, that's why we have created "At My Best".It's our connection, our way of showing we have your back. We understand that one size doesn't fit all and that priorities can change depending on your life stage. That is why our blend of wellbeing initiatives and benefits offer flexibility to suit what matters most to you. It's in the culture of our business, our QBE DNA, to support our people. Everything we do is underpinned by our QBE DNA. <s

SOC Principal Analyst

Search 510+ Threat hunter jobs near you this November. New roles added regularly across leading industries. Apply today.