Senior Security Operations Engineer (SIEM / SOAR)

We have an urgent requirement for Senior Security Operations Engineer (SIEM / SOAR) in banking domain (Must) is required for our banking clients in Abu Dhabi ,UAE

Lead the deployment, configuration, optimization, and maintenance of IBM QRadar and Microsoft Sentinel, ensuring high availability, log management, platform health monitoring, and scalability..--

Must

Drive or support QRadar to Microsoft Sentinel migration, including architecture design, rule conversion (AQL to KQL), data retention, and maintaining detection coverage during the transition.--

Must

Develop and tune security detections aligned with MITRE ATT&CK, reduce false positives, and create use cases for fraud monitoring, privileged access abuse, payment systems, and data exfiltration threats

-

-Must

Build automated response playbooks using Microsoft Sentinel Logic Apps and QRadar SOAR, integrate security tools, support SOC operations, incident response, audits, and performance reporting.

-

Must

Experience in large, regulated or 24x7 SOC environments.--Must

Banking Domain --

Must

Role Overview

We're hiring an experienced Senior Security Operations Engineer to design, deploy, configure and improve our Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) platforms. You'll be the technical lead for SIEM engineering across IBM QRadar and Microsoft Sentinel, including the move to a cloud-native SIEM.

You'll work closely with SOC analysts, incident response, infrastructure, application engineering and risk teams. Your work will make sure that security monitoring covers what it needs to, can be trusted and is audit-ready. It also needs to meet regulatory and internal control requirements.

Key Responsibilities

SIEM Engineering and Platform Management

• Deploy, configure and maintain IBM QRadar and Microsoft Sentinel, keeping them highly available and performing well.

• Design SIEM architecture, including log collection, data retention, workspace design and scaling.

• Onboard, parse and normalise log sources such as network, endpoint, identity, cloud, database and core banking applications.

• Build and run health monitoring for log sources so you can detect ingestion gaps, delays or failures and fix them.

• Manage platform upgrades, patching, licensing and capacity planning (EPS, ingestion volume and cost).

SIEM Migration

• Lead or contribute to migrating from QRadar to Microsoft Sentinel, including assessment, design, parallel running and decommissioning.

• Translate existing QRadar rules, building blocks and reference sets into Sentinel analytics rules and watchlists written in KQL (Kusto Query Language).

• Make sure detection coverage, log completeness and historical data access are maintained throughout the transition.

Detection Engineering and Use Cases

• Develop, tune and maintain detection rules mapped to the MITRE ATT&CK framework.

• Cut false positives through continuous tuning and use-case lifecycle management.

• Build use cases for banking-specific threats, such as fraud indicators, privileged access misuse, payment system monitoring and data exfiltration.

SOAR and Automation

• Design and build automated playbooks with Microsoft Sentinel playbooks (Logic Apps) and/or IBM QRadar SOAR.

• Automate enrichment, triage, containment and notification workflows to shorten response times.

• Connect SIEM/SOAR with ITSM platforms (e.g., ServiceNow), EDR, threat intelligence and identity platforms.

Operational Support and Governance

• Give SOC analysts and incident responders specialist technical support, including during major incidents.

• Produce and maintain technical documentation, runbooks, architecture diagrams and standard operating procedures.

• Support internal audit, external audit and regulatory reviews with evidence of monitoring coverage and control effectiveness.

• Track platform performance, coverage and SOC efficiency metrics and report on them.

Essential Requirements

• 5–10 years' experience in security operations, SIEM engineering or a related cyber security role.

• Proven hands-on experience deploying and configuring IBM QRadar (DSM configuration, custom properties, rules, reference data, apps).

• Strong hands-on experience with Microsoft Sentinel: workspace design, data connectors, analytics rules, workbooks and automation.

• Strong KQL skills, plus working knowledge of AQL.

• Practical experience building SOAR playbooks and security automation.

• Sound understanding of log sources, parsing, normalisation and data pipelines (Syslog, CEF, AMA, DCRs, APIs).

• Good knowledge of the MITRE ATT&CK framework and detection engineering principles.

• Working knowledge of Azure, Microsoft Defender XDR and Microsoft Entra ID.

• Scripting ability in PowerShell and/or Python.

Highly Desirable

• SIEM migration experience, particularly QRadar to Microsoft Sentinel.

• Banking or financial services experience, including familiarity with regulatory expectations for security monitoring (e.g., CBUAE, PCI DSS, SWIFT CSP).

• Experience in large, regulated or 24x7 SOC environments.

• Infrastructure-as-code experience for Sentinel deployment (ARM, Bicep, Terraform) and CI/CD for detection content.

• Experience integrating threat intelligence platforms and EDR tools.

Certifications (Preferred)

• Microsoft Certified: Security Operations Analyst Associate (SC-200)

• IBM Certified QRadar SIEM Administrator / Deployment Professional

• Relevant industry certifications such as GIAC (GCIA, GCIH, GCDA), CISSP or equivalent

Key Competencies

• Strong analytical and problem-solving ability, with attention to detail.

• Calm, structured approach under pressure, especially during high-priority incidents.

• Ability to explain technical risk clearly to non-technical and senior stakeholders.

• Collaborative, works well across IT, risk and business teams.

• Committed to continuous improvement and keeping up with the threat landscape.

Education

Bachelor's degree in Computer Science, Information Security, Engineering or a related field, or equivalent professional experience.

Skills: soar,siem,security