Job Description

Locations

• Abu Dhabi, Abu Dhabi, AE

Skills Required

• security operations disciplinesintermediate
• industry security frameworksintermediate

Required Qualifications

• Bachelor's degree in Computer Science, Information Technology, Engineering, Cybersecurity, or a related field, with 5+ years of relevant experience, or equivalent practical experience. (experience, 5 years)
• Bachelor's degree in Computer Science, Information Technology, Engineering, Cybersecurity, or a related field, with 5+ years of relevant experience, or equivalent practical experience. (experience, 5 years)
• Proven hands-on experience designing, deploying, and operating Microsoft Sentinel in enterprise environments, including security monitoring, detection engineering, automation, and large-scale SOC operations. (experience)
• Proven hands-on experience designing, deploying, and operating Microsoft Sentinel in enterprise environments, including security monitoring, detection engineering, automation, and large-scale SOC operations. (experience)
• Proven experience leading enterprise SIEM modernization and migrations to Microsoft Sentinel, including assessment, data onboarding, content migration, validation, parallel operations, and production cutover from legacy SIEM platforms. (experience)
• Proven experience leading enterprise SIEM modernization and migrations to Microsoft Sentinel, including assessment, data onboarding, content migration, validation, parallel operations, and production cutover from legacy SIEM platforms. (experience)
• Proven hands-on experience implementing Microsoft Defender for Cloud, including CSPM, CWPP, cloud governance, workload protection, security posture management, and risk reduction across Azure and multi-cloud environments. (experience)
• Proven hands-on experience implementing Microsoft Defender for Cloud, including CSPM, CWPP, cloud governance, workload protection, security posture management, and risk reduction across Azure and multi-cloud environments. (experience)
• Strong experience securing Azure Landing Zones and enterprise-scale cloud environments using Azure Policy, Management Groups, RBAC, Privileged Identity Management (PIM), and Zero Trust principles. (experience)
• Strong experience securing Azure Landing Zones and enterprise-scale cloud environments using Azure Policy, Management Groups, RBAC, Privileged Identity Management (PIM), and Zero Trust principles. (experience)
• Experience designing and securing Azure network architectures, including Azure Firewall, Firewall Manager, Web Application Firewall (WAF), DDoS Protection, Private Link, NSGs, ASGs, Virtual WAN, Secure Access Service Edge (SASE), and micro-segmentation. (experience)
• Experience designing and securing Azure network architectures, including Azure Firewall, Firewall Manager, Web Application Firewall (WAF), DDoS Protection, Private Link, NSGs, ASGs, Virtual WAN, Secure Access Service Edge (SASE), and micro-segmentation. (experience)
• Experience working with large SOCs, GSOCs, MSSPs, or managed security operations organizations, driving SOC transformation, operational excellence, and security platform adoption. (experience)
• Experience working with large SOCs, GSOCs, MSSPs, or managed security operations organizations, driving SOC transformation, operational excellence, and security platform adoption. (experience)
• Broad expertise across the Microsoft Security portfolio, including Defender XDR, Microsoft Entra, Microsoft Purview, and Security Copilot, with the ability to integrate these technologies into a unified security architecture. (experience)
• Broad expertise across the Microsoft Security portfolio, including Defender XDR, Microsoft Entra, Microsoft Purview, and Security Copilot, with the ability to integrate these technologies into a unified security architecture. (experience)
• Demonstrated success leading customer-facing engagements focused on SIEM transformation, cloud security, Zero Trust, SOC modernization, and enterprise security architecture. (experience)
• Demonstrated success leading customer-facing engagements focused on SIEM transformation, cloud security, Zero Trust, SOC modernization, and enterprise security architecture. (experience)
• Strong knowledge of security operations disciplines, including threat hunting, detection engineering, security analytics, incident response, automation, and SOC maturity improvement. (experience)
• Strong knowledge of security operations disciplines, including threat hunting, detection engineering, security analytics, incident response, automation, and SOC maturity improvement. (experience)
• Experience securing AI-enabled environments, including AI security posture management, governance, data protection, observability, threat protection, and responsible AI controls. (experience)
• Experience securing AI-enabled environments, including AI security posture management, governance, data protection, observability, threat protection, and responsible AI controls. (experience)
• Strong automation and scripting skills using KQL, PowerShell, Python, Logic Apps, REST APIs, Microsoft Graph, and security orchestration technologies. (experience)
• Strong automation and scripting skills using KQL, PowerShell, Python, Logic Apps, REST APIs, Microsoft Graph, and security orchestration technologies. (experience)
• Working knowledge of industry security frameworks and standards, including NIST, CIS, ISO 27001, and PCI DSS. (experience)
• Working knowledge of industry security frameworks and standards, including NIST, CIS, ISO 27001, and PCI DSS. (experience)
• Experience embedding security into DevSecOps, CI/CD, and platform engineering practices while collaborating effectively with engineering teams, MSSPs, partners, and operational security stakeholders. (experience)
• Experience embedding security into DevSecOps, CI/CD, and platform engineering practices while collaborating effectively with engineering teams, MSSPs, partners, and operational security stakeholders. (experience)
• SC-200: Microsoft Security Operations Analyst Associate (experience)
• SC-200: Microsoft Security Operations Analyst Associate (experience)
• AZ-500: Microsoft Azure Security Engineer Associate (experience)
• AZ-500: Microsoft Azure Security Engineer Associate (experience)

Preferred Qualifications

• SC-100: Microsoft Cybersecurity Architect Expert (experience)
• SC-100: Microsoft Cybersecurity Architect Expert (experience)
• SC-300: Microsoft Identity and Access Administrator Associate (experience)
• SC-300: Microsoft Identity and Access Administrator Associate (experience)
• SC-900: Microsoft Security, Compliance, and Identity Fundamentals (experience)
• SC-900: Microsoft Security, Compliance, and Identity Fundamentals (experience)
• AI-900: Microsoft Azure AI Fundamentals (experience)
• AI-900: Microsoft Azure AI Fundamentals (experience)
• CISSP, CCSP, GIAC or equivalent industry certification (certification)
• CISSP, CCSP, GIAC or equivalent industry certification (certification)
• This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled. (experience)

Responsibilities

• Trusted Technical Advisor: Lead security strategy, architecture, and modernization initiatives with deep specialization in Microsoft Sentinel and Microsoft Defender for Cloud. Partner with CISOs, Security Architects, and platform teams to design, deploy, optimize, and scale security solutions across SecOps, Identity, Cloud, Data, and AI Security, driving customer outcomes from strategy through operational excellence.
• Trusted Technical Advisor: Lead security strategy, architecture, and modernization initiatives with deep specialization in Microsoft Sentinel and Microsoft Defender for Cloud. Partner with CISOs, Security Architects, and platform teams to design, deploy, optimize, and scale security solutions across SecOps, Identity, Cloud, Data, and AI Security, driving customer outcomes from strategy through operational excellence.
• Microsoft Sentinel: Architect, deploy, and operationalize Microsoft Sentinel, including workspace and multi-tenant design, AMA and DCR architecture, native and custom connectors, Syslog/CEF onboarding, KQL detection engineering, incident workflows, UEBA, threat intelligence, hunting, automation rules, and Logic Apps playbooks.
• Microsoft Sentinel: Architect, deploy, and operationalize Microsoft Sentinel, including workspace and multi-tenant design, AMA and DCR architecture, native and custom connectors, Syslog/CEF onboarding, KQL detection engineering, incident workflows, UEBA, threat intelligence, hunting, automation rules, and Logic Apps playbooks.
• Microsoft Defender for Cloud: Drive adoption of Defender CSPM and Cloud Workload Protection Platform (CWPP) across servers, containers, Kubernetes, databases, storage, applications, APIs, and AI workloads. Lead secure score improvement, attack path analysis, regulatory compliance, Azure Policy governance, agentless scanning, DevOps security, and multicloud onboarding.
• Microsoft Defender for Cloud: Drive adoption of Defender CSPM and Cloud Workload Protection Platform (CWPP) across servers, containers, Kubernetes, databases, storage, applications, APIs, and AI workloads. Lead secure score improvement, attack path analysis, regulatory compliance, Azure Policy governance, agentless scanning, DevOps security, and multicloud onboarding.
• SIEM Modernization: Lead migrations from third-party SIEM platforms to Microsoft Sentinel, including assessment, data onboarding, content translation, parallel-run strategy, validation, and production cutover.
• SIEM Modernization: Lead migrations from third-party SIEM platforms to Microsoft Sentinel, including assessment, data onboarding, content translation, parallel-run strategy, validation, and production cutover.
• AI Security & Security Operations: Help customers secure and operationalize AI workloads using Security Copilot, Sentinel Data Lake, Defender for AI, Defender for Cloud AI-SPM, DSPM for AI, MCP servers, and agentic security capabilities. Drive AI-assisted detection, investigation, response, governance, and protection of AI applications, agents, and underlying data.
• AI Security & Security Operations: Help customers secure and operationalize AI workloads using Security Copilot, Sentinel Data Lake, Defender for AI, Defender for Cloud AI-SPM, DSPM for AI, MCP servers, and agentic security capabilities. Drive AI-assisted detection, investigation, response, governance, and protection of AI applications, agents, and underlying data.
• Consumption & Operational Health: Drive production adoption, operational excellence, and long-term value realization through technical consumption plans, workload onboarding, health assessments, cost governance, retention strategies, and blocker removal. Improve detection coverage, automation maturity, secure score, cloud risk posture, alert quality, ingestion efficiency, and overall platform health through continuous optimization reviews and data-driven recommendations.
• Consumption & Operational Health: Drive production adoption, operational excellence, and long-term value realization through technical consumption plans, workload onboarding, health assessments, cost governance, retention strategies, and blocker removal. Improve detection coverage, automation maturity, secure score, cloud risk posture, alert quality, ingestion efficiency, and overall platform health through continuous optimization reviews and data-driven recommendations.
• Unified Security Architecture: Design end-to-end architectures integrating Sentinel and Defender for Cloud with Defender XDR, Microsoft Entra, Microsoft Purview, Security Copilot, and Azure security services to deliver a unified security operations model.
• Unified Security Architecture: Design end-to-end architectures integrating Sentinel and Defender for Cloud with Defender XDR, Microsoft Entra, Microsoft Purview, Security Copilot, and Azure security services to deliver a unified security operations model.
• Customer Delivery: Lead architecture workshops, design sessions, proofs of concept, health assessments, and hands-on enablement to accelerate customer success.
• Customer Delivery: Lead architecture workshops, design sessions, proofs of concept, health assessments, and hands-on enablement to accelerate customer success.
• Engineering Partnership: Escalate product gaps, influence roadmap direction, capture customer feedback, and develop reusable guidance and best practices for the field and product teams.
• Engineering Partnership: Escalate product gaps, influence roadmap direction, capture customer feedback, and develop reusable guidance and best practices for the field and product teams.
• Account Collaboration: Partner with account teams, specialists, services, and partners to turn architecture decisions into deployed, consumed, and operationalized solutions.
• Account Collaboration: Partner with account teams, specialists, services, and partners to turn architecture decisions into deployed, consumed, and operationalized solutions.

Benefits

• general: Flexibility: Balance what matters—your work, your life, and your team—through trust, autonomy, and shared accountability
• general: Growth: Stretch your skills, expand your impact, and grow with support that meets you where you are
• general: Wellbeing: Support for your body, mind, and financial future—so you can stay energized and do your best work
• general: Community PCS: Find your people, build your network, and feel supported every step of the way

Travel Requirements

Less than 25%

Tags & Categories