Senior Engineer, Information Security (SOC)

About the role

Tabby is looking for a Senior Engineer, Information Security (SOC) to take technical ownership of its Security Operations Center, with a focus on SIEM engineering, detection development and threat intelligence. This is a hands-on individual contributor role in the InfoSec Monitoring department, reporting to Aseel Alghuraybi, in a regulated fintech environment.

Key responsibilities

• Own and improve the Elastic SIEM architecture, performance and reliability, including log ingestion pipelines, parsers and data retention
• Develop detection use cases aligned with MITRE ATT&CK, including custom detections for account takeover, payment fraud and API abuse
• Operationalise threat intelligence via Cyble or equivalent, enrich IOCs and integrate them into the SIEM
• Review high-severity incidents, lead post-incident reviews and monitor the managed SOC provider's performance
• Maintain incident records and security evidence aligned with SAMA CSF and NCA ECC requirements
• Mentor junior SOC analysts and engineers, and keep runbooks and playbooks up to date

Required profile

• 4-5 years of progressive experience in SOC operations, SIEM engineering, detection engineering or threat intelligence
• Hands-on Elastic Stack experience, including ingestion pipelines and performance tuning
• Proven ability to build complex detection rules and correlation logic
• Experience with MITRE ATT&CK and threat intelligence platforms such as Cyble
• Knowledge of fintech threats and frameworks such as SAMA CSF, NCA ECC, PDPL and PCI DSS
• Relevant Elastic and GIAC certifications required; CISSP, CISM or equivalent is an advantage

Required skills

• Elastic Stack (SIEM administration, architecture, ingestion pipelines)
• MITRE ATT&CK and detection coverage analysis
• Threat intelligence platforms (Cyble or equivalent)
• Incident investigation, root cause analysis and scripting/automation, preferably Python
• Log integration from cloud environments such as AWS and GCP