SOC Analyst Level 3 – Riyadh

About the role

The SOC Analyst Level 3 is the senior escalation point within the Security Operations Center in Riyadh. You will lead advanced threat detection, complex incident investigations and mentor junior analysts to raise the overall SOC maturity.

Key responsibilities

• Lead high‑severity incident response and threat‑hunting across endpoint, network, cloud and identity layers.
• Develop, tune and maintain detection content, correlation rules and custom log parsers aligned with MITRE ATT&CK.
• Provide guidance, mentorship and technical support to L1/L2 analysts, improve playbooks and drive automation.
• Prepare detailed incident reports for technical and executive audiences, including remediation recommendations.

Required profile

• 5‑8+ years of experience in SOC operations, DFIR and incident response.
• Proven ability to handle complex multi‑source investigations and mentor junior staff.
• Strong understanding of security frameworks such as NCA, SAMA, ISO 27001 and MITRE ATT&CK.
• Excellent analytical skills with a focus on reducing false positives and improving detection fidelity.

Required skills

• Hands‑on expertise with EDR, SIEM and SOAR platforms.
• Proficiency in Sigma, KQL, SPL, YARA and custom log parsing.
• Experience with packet analysis, network forensics and cloud security logs (Azure, AWS, GCP).
• Knowledge of malware behavior, reverse engineering fundamentals and digital forensics.
• Familiarity with identity security, authentication analytics and incident response processes.