Detection Analyst

We are seeking an experienced Detection Analyst to join our client’s cybersecurity team in Riyadh.

This role is fully on-site at the client’s premises and requires a strong background in SIEM/XDR detection engineering, advanced query development, and security monitoring optimization, with experience in Palo Alto Networks Cortex XSOAR being an advantage.

Support the Security Detection Lead in designing, developing, implementing, and tuning SIEM/XDR detection content to improve threat detection coverage, accuracy, and operational effectiveness.

Develop, maintain, and optimize correlation rules, detection logic, dashboards, and reports across SIEM/XDR platforms.

Analyze alert patterns, security events, and incident data to identify detection gaps and tuning opportunities.

Translate threat intelligence findings and incident response insights into actionable detection rules and use cases.

Perform regression testing for new and updated detection rules to validate functionality, accuracy, and performance.

Maintain comprehensive documentation for detection rules, including logic, data sources, expected behavior, and tuning history.

Collaborate with Tier-1 and Tier-2 SOC analysts to gather feedback and continuously improve detection effectiveness.

Map detection use cases and rules to the MITRE ATT&CK framework and applicable regulatory controls.

Support the integration and optimization of detection and incident response workflows using Cortex XSOAR, where applicable.

Support continuous improvement of detection coverage while minimizing false positives and improving alert quality.

5+ years of experience in SOC operations, detection engineering, or cybersecurity monitoring, with strong expertise in detection development and tuning.

Advanced experience developing SIEM queries, correlation rules, and detection logic.

Hands-on experience with SIEM/XDR platforms, alert analysis, and detection optimization.

Experience with Palo Alto Networks Cortex XSOAR, including playbook automation, incident workflows, integrations, or security orchestration, is preferred.

Proven experience in detection rule testing, validation, regression testing, and technical documentation.

Strong understanding of threat intelligence, incident response, and security event analysis.

Familiarity with MITRE ATT&CK and mapping detection capabilities to adversary tactics and techniques.

Strong analytical, troubleshooting, and collaboration skills.

Relevant certifications in security operations, SIEM technologies, threat detection, or incident response.

Vendor-specific SIEM/XDR certifications.

• Palo Alto Networks Cortex XSOAR-related training or certifications are an advantage.