Security Analyst

Core
42, a leader in AI-powered cloud and digital infrastructure, is driving transformative technology solutions globally. Leveraging advanced resources and partnerships, Core
42 empowers clients to harness sovereign AI infrastructure, especially in sectors with stringent regulatory needs. With a mission to redefine digital transformation, we combine sovereign capabilities with scalable, high-performance compute infrastructure, positioning itself at the forefront of AI innovation in the Middle East and beyond.

Security Analyst, Core
42 - Abu Dhabi, UAE. We are looking for a Security Analyst to anchor the technical depth of our 24x7 Security Operations Centre. This role detects, triages, investigates and responds to security incidents across our private-cloud platform and the enterprise services it supports. The successful candidate is a hands-on practitioner who can own an incident end to end from the first alert in Splunk through containment, eradication and recovery - while also raising the quality of our detections and acting as a senior escalation point and mentor for less-experienced analysts.

The environment is a private cloud built on Open Stack and Red Hat Open Shift, instrumented with Splunk (SIEM), Cribl (data pipeline), Elastic Security (EDR) and Corelight (NDR). Comfort working across virtualised and containerised infrastructure log sources is expected. The role reports to the SOC Manager and operates on a full-time, 24x7 rotational shift basis.

• Monitor security alerts and events in Splunk to identify threats, anomalies and malicious activity across the private-cloud platform and enterprise services
• Perform triage and investigation of security events, acting as the senior technical decision point on whether an alert represents a genuine incident
• Serve as the senior escalation point for front-line analysts, providing investigative guidance and validating findings before escalation
• Investigate EDR and NDR alerts involving malware, suspicious scripts, credential theft, lateral movement, persistence, ransomware and endpoint or network compromise

• Own security incidents end to end across the full response lifecycle: identification, containment, eradication, recovery and post-incident review
• Execute containment and remediation actions in coordination with platform, infrastructure, network and application teams
• Lead the response on assigned incidents and coordinate cross-team activity to ensure timely investigation, escalation and resolution
• Develop and maintain incident response playbooks and standard operating procedures (SOPs), and drive their improvement after each major incident
• Create, tune and optimise Splunk correlation searches, alerts, dashboards and reports to improve detection quality and coverage
• Write and maintain efficient SPL queries supporting investigation, hunting, reporting and detection engineering
• Reduce alert fatigue by tuning noisy detections, lowering false positives and strengthening correlation logic, weighing false-positive cost against miss cost when making tuning decisions
• Support onboarding of new log sources and validate log quality, parsing, field extraction and normalisation
• Manage and maintain Cribl Stream/Edge pipelines for log routing, filtering, enrichment and normalisation, optimising data flow and Splunk licence consumption
• Conduct hypothesis-driven threat hunts to uncover advanced persistent threats (APTs) and techniques that evade existing detections
• Map detection coverage to MITRE ATT&CK, identify and report gaps, and convert successful hunts into durable detections
• Apply threat intelligence and frameworks (MITRE ATT&CK, Cyber Kill Chain, Diamond Model) to enrich investigations and improve detection and response
• Identify patterns, trends and indicators of compromise (IOCs) to proactively detect and prevent recurrence

• Conduct root cause analysis (RCA) and produce clear incident reports for management and stakeholders
• Maintain accurate, detailed records of incidents, actions taken, evidence collected and lessons learned in the case-management platform
• Contribute to the continuous improvement of security monitoring use cases and detection rules
• Support audit and compliance requirements by providing evidence of incident-management activities

• Operate within a 24x7 SOC, participating in rotational day, evening and night shifts,…