{"id":2002920,"url":"https://alion.io/job/security-analyst","title":"Security Analyst","company":{"id":48611,"name":"Core42","domain":"core42.ai","url":"https://alion.io/company/core42","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United Arab Emirates"],"countries":["AE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":50000,"max_usd":117000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":1891},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"Corelight","optional":false},{"name":"Diamond Model","optional":false},{"name":"DNS","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"Jira","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OpenShift","optional":false},{"name":"OpenStack","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Hat","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false},{"name":"Kubernetes","optional":true}],"status":"live","first_seen_at":"2026-10-07T12:20:00Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-10-13T00:49:35Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"About Us\n\nCore42, a leader in AI-powered cloud and digital infrastructure, is driving transformative technology solutions globally. Leveraging advanced resources and partnerships, Core42 empowers clients to harness sovereign AI infrastructure, especially in sectors with stringent regulatory needs. With a mission to redefine digital transformation, we combine sovereign capabilities with scalable, high-performance compute infrastructure, positioning itself at the forefront of AI innovation in the Middle East and beyond.\nThe opportunity\n\nSecurity Analyst, Core42 - Abu Dhabi, UAE. We are looking for a senior Security Analyst to anchor the technical depth of our 24x7 Security Operations Centre. This role detects, triages, investigates and responds to security incidents across our private-cloud platform and the enterprise services it supports. The successful candidate is a hands-on practitioner who can own an incident end to end - from the first alert in Splunk through containment, eradication and recovery - while also raising the quality of our detections and acting as a senior escalation point and mentor for less-experienced analysts. The environment is a private cloud built on OpenStack and Red Hat OpenShift, instrumented with Splunk (SIEM), Cribl (data pipeline), Elastic Security (EDR) and Corelight (NDR). Comfort working across virtualised and containerised infrastructure log sources is expected. The role reports to the SOC Manager and operates on a full-time, 24x7 rotational shift basis.\nYour key responsibilities\nSecurity monitoring, triage & detection\nMonitor security alerts and events in Splunk to identify threats, anomalies and malicious activity across the private-cloud platform and enterprise services\nPerform triage and investigation of security events, acting as the senior technical decision point on whether an alert represents a genuine incident\nServe as the senior escalation point for front-line analysts, providing investigative guidance and validating findings before escalation\nInvestigate EDR and NDR alerts involving malware, suspicious scripts, credential theft, lateral movement, persistence, ransomware and endpoint or network compromise\nIncident response (full lifecycle)\nOwn security incidents end to end across the full response lifecycle: identification, containment, eradication, recovery and post-incident review\nExecute containment and remediation actions in coordination with platform, infrastructure, network and application teams\nLead the response on assigned incidents and coordinate cross-team activity to ensure timely investigation, escalation and resolution\nDevelop and maintain incident response playbooks and standard operating procedures (SOPs), and drive their improvement after each major incident\nSIEM, detection engineering & log pipeline\nCreate, tune and optimise Splunk correlation searches, alerts, dashboards and reports to improve detection quality and coverage\nWrite and maintain efficient SPL queries supporting investigation, hunting, reporting and detection engineering\nReduce alert fatigue by tuning noisy detections, lowering false positives and strengthening correlation logic, weighing false-positive cost against miss cost when making tuning decisions\nSupport onboarding of new log sources and validate log quality, parsing, field extraction and normalisation\nManage and maintain Cribl Stream/Edge pipelines for log routing, filtering, enrichment and normalisation, optimising data flow and Splunk licence consumption\nThreat hunting & intelligence\nConduct hypothesis-driven threat hunts to uncover advanced persistent threats (APTs) and techniques that evade existing detections\nMap detection coverage to MITRE ATT&CK, identify and report gaps, and convert successful hunts into durable detections\nApply threat intelligence and frameworks (MITRE ATT&CK, Cyber Kill Chain, Diamond Model) to enrich investigations and improve detection and response\nIdentify patterns, trends and indicators of compromise (IOCs) to proactively detect and prevent recurrence\nDocumentation, reporting & governance\nConduct root cause analysis (RCA) and produce clear incident reports for management and stakeholders\nMaintain accurate, detailed records of incidents, actions taken, evidence collected and lessons learned in the case-management platform\nContribute to the continuous improvement of security monitoring use cases and detection rules\nSupport audit and compliance requirements by providing evidence of incident-management activities\nWorking arrangement\nOperate within a 24x7 SOC, participating in rotational day, evening and night shifts, including weekends and public holidays on a rotational basis\nMeet defined acknowledgement, triage and escalation SLAs on each shift and complete structured shift handovers to maintain continuity of in-flight incidents\nWhat we’re looking for\n\n(a) Required skills / qualifications\nBachelor's degree in Computer Science, Information Security, Cybersecurity or a related field; equivalent professional experience and certifications will be considered in lieu of a degree\n5-8 years in security operations, incident response or SOC monitoring, with at least 2 years at a senior level\nProven hands-on experience with Splunk Enterprise / Splunk Cloud - advanced SPL, dashboard development, correlation searches, alert creation and tuning, and administration\nDemonstrated experience with Cribl Stream / Cribl Edge - log routing, parsing, filtering, enrichment and pipeline management\nStrong background in incident analysis, investigation, evidence handling, escalation management and full-lifecycle response aligned with industry standards, including playbook and SOP development and RCA\nElastic Security (EDR) and Corelight (NDR) for endpoint and network threat detection, investigation and response\nThreat frameworks: MITRE ATT&CK (including coverage mapping), Cyber Kill Chain and Diamond Model\nStrong understanding of networking: TCP/IP, DNS, HTTP/S, firewalls, proxies and IDS/IPS\nProficiency in Windows and Linux environments\nProficiency in Python, Bash or PowerShell for automation and analysis\nFamiliarity with private-cloud and platform log sources: Red Hat OpenShift, OpenStack, Commvault, Scality and related infrastructure\nServiceNow, Jira or equivalent ticketing/case management for incident tracking, evidence attachment, escalation notes and closure documentation\n(b) Preferred skills / qualifications\nSplunk Core Certified Power User or Splunk Certified Admin\nCribl Certified Admin\nGIAC certifications relevant to detection and response - GCIA, GCIH, GCDA or GCFA\nBlue Team Level 2 (BTL2) or equivalent hands-on defensive certification\nExperience monitoring OpenStack and Kubernetes/OpenShift environments\nFamiliarity with detection-as-code practices (version control and peer review of detection content)\nWhat working at Core42 offers\nWith a diverse team of 1,100+ employees from 68 nationalities, we foster an inclusive, innovative and collaborative environment. At Core42, we foster a culture grounded in trust, accountability and high performance. We are united by our values: Grit, where we overcome challenges with resilience and determination, Passion, which drives us to pursue excellence in everything we do, and Impact, as we aim to inspire progress and create meaningful change. Our team members thrive in an environment where each person’s contributions propel us forward, and together, we commit to achieving extraordinary results.\nCompetitive Salary: We offer an attractive salary package based on your skills and experience\nYearly Bonus: In recognition of your contributions, you will receive a performance-based annual bonus\nExclusive Discount Cards: Access special benefits with Esaad and Fazaa cards, offering discounts across a wide range of services\nPremium Family Insurance: We provide comprehensive health coverage, including dental, vision and life insurance, ensuring the well-being of you and your family\nLearning & Development: We offer access to top-tier learning platforms to help you grow in your career. Learn at your own pace with unlimited access to premium courses.","description_format":"text","description_chars":8117,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Life insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Data Centers & Colocation","Cloud Platforms (IaaS & PaaS)","AI Compute & Inference"],"lifecycle":[{"event":"open","at":"2026-10-07T12:20:00Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":4,"expected_fill_days":28,"reasons":["conf:4","win:early"],"computed_at":"2026-10-12T06:55:09Z"},"pay":null,"html_url":"https://alion.io/job/security-analyst","json_url":"https://alion.io/job/security-analyst.json","meta":{"generated_at":"2026-10-13T03:19:40Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5118,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":48611},"rest":"https://alion.io/mcp/rest/get_company?id=48611"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsecurity-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsecurity-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsecurity-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/security-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsecurity-analyst"}]}