Responsibilities:

Security monitoring & incident investigation
Investigate and analyze security incidents escalated by SOC L1 analysts.
Validate security events and determine scope, impact, severity, and business risk.
Perform advanced correlation and analysis of logs, alerts, network activity, endpoint telemetry, and threat intelligence.
Conduct root cause analysis of security incidents and identify indicators of compromise (IOCs).
Support incident containment, eradication, and recovery activities.
Escalate incidents requiring specialized investigation or incident response support.

Threat detection & threat hunting
Perform proactive threat hunting activities to identify malicious activity that may bypass automated controls.
Utilize threat intelligence sources to identify emerging threats and attacker tactics.
Analyze attack patterns, indicators, and behaviors associated with malware, ransomware, insider threats, advanced persistent threats (APTs).
Identify opportunities to improve detection coverage across monitored environments.

SIEM & detection engineering
Develop, tune, and optimize SIEM use cases and correlation rules.
Support creation and maintenance of detection logic, dashboards, reports, alerts, and monitoring workflows.
Reduce false positives through tuning and rule optimization.
Support onboarding and integration of new log sources.

Incident management & reporting
Maintain detailed incident records and investigation documentation.
Prepare technical analysis and incident reports.
Support operational metrics, reporting, and service reviews.
Ensure incident handling activities comply with established procedures and SLAs.

Technical leadership & knowledge transfer
Provide guidance and mentoring to L1 SOC analysts.
Support analyst development through coaching and technical knowledge sharing.
Participate in continuous improvement initiatives and SOC maturity programs.
Contribute to process, playbook, and procedure development.

Our culture & code of conduct:

At ZainTECH, we take pride in a culture built on collaboration, innovation, and uncompromising integrity. We are looking for individuals who share these values and are committed to customer-centricity and ethical excellence. All employees are expected to uphold our code of conduct, which serves as a guiding framework for responsible behavior across everything we do — from how we work with each other to how we engage with clients and partners globally.

Requirements:

• Minimum 3 years experience in managed cybersecurity / SOC operations at an investigative level.
• Strong SIEM investigation, detection-rule development, log and network analysis, and use-case tuning.
• Bachelor’s degree in cybersecurity, information security, computer science, information technology, engineering, or a related field.
• Security+, GCIA, GCIH certification preferred.