SOC L3 (DFIR) Engineer - Security Operations Center

About the role

Accenture is looking for an experienced SOC L3 (DFIR) Engineer to act as a senior escalation point within its Security Operations Center in Jeddah, Saudi Arabia. The role leads complex incident response investigations, performs digital forensics and drives SIEM engineering and tuning, while mentoring junior SOC analysts.

Key responsibilities

• Act as the primary escalation point for complex, high-severity incidents escalated from L1 and L2 analysts.
• Lead end-to-end incident response investigations, including containment, eradication and recovery.
• Perform digital forensics on endpoints, networks and logs to determine root cause and impact.
• Tune SIEM use cases, correlation rules and alerting logic to reduce false positives and improve detection.
• Develop and maintain incident response playbooks and SOC procedures.
• Work with the CTI team to bring threat intelligence into detection and response.
• Mentor L1 and L2 analysts and prepare incident reports presented to management and clients.

Required profile

• 2-5 years of experience in a SOC environment, with hands-on L3 (DFIR) experience.
• Saudi nationals only.
• Preferred: relevant certifications such as GCIH, GCFE, GCFA, Splunk Certified, Microsoft SC-200 or equivalent.
• Preferred: knowledge of Saudi Arabia's NCA cybersecurity regulations and compliance requirements.

Required skills

• Incident response and digital forensics.
• Hands-on SIEM platforms such as Splunk, Microsoft Sentinel or QRadar, including rule creation and tuning.
• Network protocols, attack techniques and threat actor TTPs.
• Familiarity with the MITRE ATT&CK framework.