Information Security Engineer (SOC L2)

About the role

Tabby is looking for an Information Security Engineer (SOC L2) to join its InfoSec Monitoring team in Saudi Arabia. You will be responsible for protecting the company’s infrastructure, applications and cloud environments by monitoring security events, responding to incidents and enhancing detection capabilities.

Key responsibilities

• Monitor and analyze logs and alerts from firewalls, IDS/IPS, endpoints, servers and cloud platforms.
• Correlate events across multiple sources to identify advanced threats and reduce false positives.
• Maintain dashboards and reporting for real‑time visibility of the security posture.
• Act as the frontline responder for security incidents, managing detection, containment, eradication, recovery and lessons learned.
• Coordinate with internal stakeholders and external vendors during high‑severity incidents or data breaches.
• Perform root‑cause analysis and forensic investigations using endpoint and network artifacts.
• Research emerging threats, develop and tune detection rules, threat‑hunting queries and use cases.
• Integrate CTI feeds with security controls to enable active threat‑driven detections.
• Communicate incident status to stakeholders and mentor junior analysts.

Required profile

• Demonstrated experience in security monitoring, incident response and threat intelligence within a SOC environment.
• Ability to work collaboratively with IT, DevOps, Risk and Compliance teams.
• Strong analytical and problem‑solving skills, with attention to detail.

Required skills

• Log analysis and alert triage
• Firewalls, IDS/IPS, endpoint protection platforms
• Cloud security monitoring (e.g., AWS, Azure, GCP)
• Detection rule creation and tuning
• CTI feed integration
• Forensic investigation techniques