SOC Engineer

Job Overview

We are seeking a skilled SOC Engineer to join our team in Doha, Qatar, offering a competitive salary of 18,000 to 20,000 QAR per month. This role involves continuous security monitoring, incident detection, response, investigation, and reporting within a Security Operations Center environment.

Key Responsibilities

• Constantly monitor security alerts from SIEM, XDR, EDR systems, NDR, IDS/IPS, firewalls, and cloud environments to detect and prioritize incidents based on urgency and impact to business operations.
• Conduct thorough investigations into security incidents, analyze malware and attack methods, determine root causes, assist in containment, eradication, and recovery efforts.
• Perform scheduled threat hunting activities including executing queries, validating suspicious behaviors, and documenting findings.
• Support vulnerability management by reviewing scan reports, tracking remediation, validating patch installations, and updating related tickets.
• Maintain detailed incident documentation, prepare operational reports, ensure adherence to service level agreements, and manage shift handover notes.

Required Skills and Experience

• Between 1 and 4 years of experience working in a Security Operations Center.
• Proficient in monitoring security alerts from tools such as SIEM, EDR/XDR, IDS/IPS, firewalls, email security, and cloud security solutions.
• Knowledgeable in alert triage, incident classification, escalation protocols, and ticket handling processes.
• Understanding of network fundamentals including TCP/IP, DNS, HTTP/HTTPS, VPN, routing, switching, and related protocols.
• Experience with Windows and Linux administration, system log analysis, and endpoint protection techniques.
• Familiar with common cyber threats including phishing, malware, ransomware, brute force attempts, web-based attacks, and potential insider threats.

Educational and Certification Requirements

• Bachelor's degree in Cybersecurity, IT, Computer Science, or similar disciplines.
• Relevant certifications such as CompTIA Security+, CompTIA CySA+, EC-Council Certified Network Defender (CND), Cisco CyberOps Associate, or Microsoft SC-200.
• Additional certifications like CHFI and DFIR Foundations are considered beneficial.

Technical and Job-Specific Skills

• Strong capabilities in incident documentation, communication, and coordination with teams during security events.
• Basic scripting knowledge in PowerShell, Python, or Bash is advantageous for automation and log analysis.
• Competency in analyzing logs from endpoints, servers, firewalls, proxies, Active Directory, cloud platforms, and other security systems.