{"id":2508453,"url":"https://alion.io/job/malomatia-senior-cybersecurity-consultant","title":"Senior Cybersecurity Consultant","company":{"id":1129,"name":"Malomatia","domain":"malomatia.com","url":"https://alion.io/company/malomatia","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"A","score":96,"open_postings":10,"ghost_share":0,"stale_share":0.1,"repost_share":0.1,"time_to_fill_p50_days":37,"computed_at":"2026-11-02T06:13:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Doha, Qatar"],"countries":["QA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":68000,"max_usd":158000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"DLP","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"SIEM","optional":false},{"name":"Active Directory","optional":true},{"name":"CIS Benchmarks","optional":true},{"name":"Defense in Depth","optional":true},{"name":"ISO 27001","optional":true},{"name":"Least Privilege","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"PowerShell","optional":true},{"name":"Zero Trust","optional":true}],"status":"live","first_seen_at":"2026-10-14T07:37:33Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-11-02T22:41:36Z","board_verified":true,"closed_at":null,"days_open":19,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":19},"description":"The Senior Cybersecurity Consultant will join our Cybersecurity Practice as an Incident Handler within the security operations function. The role involves leading the detection, investigation, containment, and recovery of security incidents across enterprise and cloud environments, with a strong focus on the Microsoft security ecosystem.\nResponsibilities will center on incident handling and response, threat detection and hunting, and the day-to-day operation of Microsoft security tooling, including Microsoft Defender (EDR/XDR), Microsoft Sentinel, Microsoft Purview, and Data Loss Prevention (DLP). The role will drive incidents through the full response lifecycle and continuously improve detection and response capabilities.\nThe consultant will work closely with SOC analysts, threat intelligence, and IT operations teams to triage alerts, lead investigations, coordinate containment and eradication, and conduct post-incident reviews. The role also involves tuning detections, developing response playbooks, and supporting proactive threat hunting across the Microsoft 365 and Azure estate.\nThe position requires deep, hands-on operational expertise in incident response and the Microsoft security stack, strong analytical and forensic capabilities, and the ability to remain calm and decisive under pressure during active security incidents.\n Incident Handling & Response: Lead the end-to-end handling of security incidents, including detection, triage, investigation, containment, eradication, and recovery, in line with established incident response processes and SLAs.\n Microsoft Defender (EDR/XDR): Operate, tune, and investigate using Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps to detect and respond to threats across endpoints, identities, email, and cloud workloads.\n Microsoft Sentinel (SIEM/SOAR): Use Microsoft Sentinel for log analysis, correlation, and automated response. Develop and tune analytic rules, KQL queries, workbooks, and SOAR playbooks to improve detection coverage and response efficiency.\nMicrosoft Purview & Data Security: Leverage Microsoft Purview for data governance, information protection, insider risk management, and compliance. Investigate data-related alerts and support data security and DLP operations.\n Data Loss Prevention (DLP): Configure, monitor, and respond to DLP policies across Microsoft 365 and endpoints to detect and prevent unauthorized data exfiltration, and refine policies to reduce false positives.\nThreat Hunting & Detection Engineering: Conduct proactive threat hunting across the Microsoft 365 and Azure estate, develop new detections, and continuously improve detection logic based on threat intelligence and lessons learned.\nForensics & Root Cause Analysis: Perform host, endpoint, and cloud-based investigations and digital forensics to determine root cause, scope, and impact of incidents, preserving evidence in line with best practices.\nDocumentation & Reporting: Produce high-quality incident reports, timelines, and post-incident reviews. Maintain runbooks and playbooks, and provide clear incident updates to internal stakeholders and clients.\n Education: Bachelor’s / college degree in Computer Science, Information Security, or a related field.\nExperience: At least 8 years of experience in cybersecurity operations, incident response, or security monitoring, with significant hands-on experience operating Microsoft security tools.\n Certifications: Relevant professional certifications are highly desirable. These may include, but are not limited to:Microsoft Security Operations Analyst (SC-200)\nMicrosoft Certified: Cybersecurity Architect (SC-100) or Information Protection (SC-400)\nGIAC incident response / forensics (e.g., GCIH, GCFA) or equivalent\nISC2 (e.g., SSCP or CISSP) or CompTIA CySA+.\n\n Technical Skills: Strong hands-on experience with the Microsoft security stack, including Microsoft Defender (EDR/XDR), Microsoft Sentinel, Microsoft Purview, and Microsoft 365 DLP. Proficiency with KQL for investigation and detection. Experience with EDR investigation, log analysis, SIEM/SOAR, endpoint and cloud forensics, and identity platforms (Entra ID and Active Directory). Familiarity with scripting (e.g., PowerShell) for automation is preferred.\n Knowledge: Strong understanding of incident response methodologies and frameworks (e.g., NIST SP 800-61, SANS), the MITRE ATT&CK framework, the cyber kill chain, and modern attacker techniques. Solid grasp of cybersecurity principles including defense-in-depth, zero trust, and least privilege. Familiarity with ISO 27001 and CIS Benchmarks. Knowledge of Qatar National Information Assurance (NIA) is a plus.","description_format":"text","description_chars":4714,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response","Call Center Services"],"lifecycle":[{"event":"open","at":"2026-10-14T08:28:48Z"}],"visa":[],"liveness":{"score":81,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.901,"p_room":0.9,"age_days":18,"expected_fill_days":37,"reasons":["conf:4","velocity","win:mid"],"computed_at":"2026-11-02T06:13:15Z"},"pay":null,"html_url":"https://alion.io/job/malomatia-senior-cybersecurity-consultant","json_url":"https://alion.io/job/malomatia-senior-cybersecurity-consultant.json","meta":{"generated_at":"2026-11-02T23:54:09Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":33450,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1129},"rest":"https://alion.io/mcp/rest/get_company?id=1129"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmalomatia-senior-cybersecurity-consultant"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmalomatia-senior-cybersecurity-consultant"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmalomatia-senior-cybersecurity-consultant"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/malomatia-senior-cybersecurity-consultant\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmalomatia-senior-cybersecurity-consultant"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2508453}},{"tool":"search_jobs","arguments":{"company":"malomatia.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2508453},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}