Cyber Defense Center Analyst; CDC

Join a dynamic cybersecurity team responsible for monitoring, analyzing, and responding to security events across enterprise systems. The CDC L2 Analyst will conduct in-depth investigations of escalated alerts, perform triage to identify real threats, and take initial containment actions, helping maintain a secure and resilient IT environment.

This role blends technology, security operations, and compliance, providing a key contribution to proactive threat detection and incident response initiatives.

• Monitor and analyze security alerts from SIEM, SOAR, EDR, WAF, API gateways, and cloud services.
• Perform Level 2 triage to validate true positives, eliminate false positives, and detect malicious behavior.
• Conduct deep‑Dive investigations across endpoints, identities, APIs, networks, and cloud services.
• Execute initial containment measures such as account lockout, isolation, or token revocation.
• Escalate complex incidents with complete investigation notes and evidence.
• Document incidents and actions with regulatory‑aligned traceability.
• Support threat hunting activities and propose new detection rules and playbooks.
• Analyze cloud security events, including IAM anomalies, API misuse, container threats, and serverless misuse.
• Validate and improve monitoring rules and playbooks.
• Provide structured handovers to other security teams and stakeholders.
• Participate in post‑incident reviews and continuous improvement initiatives.

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or equivalent.

• Security monitoring & incident response (SIEM, SOAR, EDR, WAF, API gateways, cloud logs)
• Endpoint, network, identity, and cloud security analysis
• Threat detection, triage, and containment
• Incident documentation aligned with regulatory standards

• Minimum 3–5 years in cybersecurity monitoring, SOC operations, or incident response
• Experience handling escalated security alerts (L2 triage)
• Exposure to multi‑team and multi‑vendor IT environments
• Banking, Fin Tech or financial services cybersecurity experience is a plus

• Strong analytical and problem‑solving capabilities
• Excellent communication and collaboration skills
• Ability to work independently in a hybrid environment
• Highly organized with attention to detail
• Proactive and accountable for security outcomes
• Engagement type:
  Project‑based / Consulting
• Work setup:
  Hybrid – Riyadh, KSA (3x a week on site)
• Visa requirement:
  Open to IQAMA holders

Mid‑Senior level

Contract

Information Technology

Business Consulting and Services