Cyber Security Specialist - OSN

Role Purpose

The Cyber Security Specialist is a critical technical role responsible for protecting OSN's digital assets, content delivery infrastructure, and enterprise systems against cyber threats. Operating across cloud and on-premises environments, the role combines proactive security engineering with real‑time threat detection, incident response, and regulatory compliance — ensuring OSN maintains resilient, secure operations across all business units.

• Security Operations & Incident Response
• Lead end‑to‑end security incident management: detection, triage, containment, eradication, recovery, and post‑incident review.
• Operate as the primary escalation point within the SOC for Tier 2/3 security incidents and complex investigations.
• Develop and maintain incident response playbooks, runbooks, and communication frameworks aligned with NIST CSF and ISO 27035.
• Conduct forensic analysis of compromised systems, endpoints, and network activity; produce formal incident reports for technical and executive audiences.
• Coordinate with external MSSPs, threat intelligence vendors, and UAE regulatory bodies (e.g., UAE CIRT) during significant incidents.
• Threat Detection, Hunting & Analytics
• Design and implement advanced detection rules, correlation logic, and SIEM use cases to identify sophisticated threats and anomalous behaviour.
• Conduct structured threat‑hunting exercises using frameworks such as MITRE ATT&CK to proactively surface hidden adversary activity.
• Analyse threat intelligence feeds and translate findings into actionable detection improvements and security control enhancements.
• Monitor OSN's attack surface continuously; track indicators of compromise (IoCs) and indicators of attack (IoAs) across all environments.
• Produce weekly threat landscape briefings for the security leadership team.
• Security Technology Administration
• Administer, tune, and optimise the security technology stack, including:
• SIEM (Microsoft Sentinel / Splunk) — rule authoring, dashboard development, log source onboarding
• DLP — policy configuration, alert triage, data classification framework integration
• WAF — ruleset management, bot mitigation, DDoS response coordination
• PAM — onboarding, policy governance, session recording review
• Vulnerability Management (Tenable / Qualys) — scan configuration, risk‑based prioritisation
• Drive continuous improvement programmes across all security technologies, ensuring tools are fully utilised and aligned to current threat models.
• Cloud & Infrastructure Security
• Define and enforce security baselines, policies, and guardrails for Azure, AWS, and Microsoft 365 environments using native and third‑party tooling.
• Lead cloud security posture management (CSPM) activities; identify and remediate misconfigurations and compliance gaps across IaaS, PaaS, and SaaS layers.
• Architect and implement zero‑trust network access (ZTNA) controls and identity‑centric security models for cloud workloads.
• Review and approve infrastructure‑as‑code (IaC) templates (Terraform, ARM) for security compliance before deployment.
• Partner with Dev Ops and platform engineering teams to embed security into CI/CD pipelines (shift‑left security / Dev Sec Ops ).
• Vulnerability Management & Penetration Testing
• Own the end‑to‑end vulnerability management lifecycle: discovery, risk scoring (CVSS), prioritisation, remediation tracking, and reporting.
• Conduct internal penetration tests and red team exercises against web applications, APIs, cloud environments, and internal network segments.
• Manage relationships with external penetration testing vendors; review findings, validate remediations, and track exceptions.
• Maintain a formal risk register for open vulnerabilities and present quarterly status updates to IT leadership.
• Application & API Security
• Champion application security best practices aligned with OWASP Top 10, SANS CWE Top 25, and OSN's secure development lifecycle (SDL).
• Perform manual and automated security code reviews and DAST/SAST assessments for web applications, mobile apps, and internal platforms.
• Define and enforce API security standards; monitor for API abuse, injection attacks, and authentication weaknesses.
• Provide developer…