{"id":3447086,"url":"https://alion.io/job/tabby-senior-engineer-information-security-soc","title":"Senior Engineer, Information Security (SOC)","company":{"id":255,"name":"Tabby","domain":"tabby.ai","url":"https://alion.io/company/tabby","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Pinpoint","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Riyadh, Saudi Arabia"],"countries":["SA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":49000,"max_usd":113000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"GCP","optional":false},{"name":"Incident Management","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-10-28T08:51:42Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-10-31T22:29:27Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"We’re looking for a Senior Engineer, Information Security (SOC) to take technical ownership of our Security Operations Center capabilities, with a particular focus on SIEM engineering, detection development, and threat intelligence.\nThis is a hands-on senior individual contributor role for someone who can go beyond monitoring alerts and improve how security threats are detected, investigated, and managed. You’ll own and continuously improve our Elastic SIEM platform, develop advanced detection use cases, operationalize threat intelligence, and ensure the quality of incident response and our managed SOC provider’s performance.\nYou’ll also act as a key technical escalation point, mentor junior team members, and work closely with internal stakeholders and external partners to strengthen Tabby’s security capabilities in a regulated fintech environment.\nKey Responsibilities:\nSIEM Engineering & Platform Ownership\nOwn and improve the architecture, performance, and reliability of our Elastic SIEM environment.\nDesign and maintain log ingestion pipelines, integrations, parsers, and data retention strategies.\nExpand log source coverage, improve data quality, and troubleshoot complex platform issues.\nEstablish standards for log onboarding and regularly assess SIEM health, visibility, and resilience.\n\nDetection Engineering\nDevelop, maintain, and improve detection use cases aligned with the MITRE ATT&CK framework.\nBuild custom detections for fintech-specific threats, including account takeover, payment fraud, and API abuse.\nReview and validate detection logic, identify false positives and coverage gaps, and improve detection quality.\nConduct threat modelling and detection gap analysis to identify potential attack paths and strengthen monitoring coverage.\n Cyber Threat Intelligence (CTI)\nDrive threat intelligence operations using Cyble or equivalent platforms.\nAnalyse threat actors, campaigns, indicators of compromise (IOCs), and emerging threats relevant to Tabby.\nEnsure actionable intelligence is validated, enriched, and integrated into Elastic SIEM.\nOversee brand protection activities, including prioritising findings and coordinating takedown cases.\nSupport threat intelligence sharing with relevant stakeholders and regulatory bodies.\nSOC Governance & Incident Management\nReview high-severity incidents, validate escalations, and support effective incident resolution.\nLead post-incident reviews and ensure root causes, remediation steps, and corrective actions are documented and tracked.\nMonitor the performance of our managed SOC provider, including service levels, detection quality, and reporting.\nMaintain incident records and security evidence aligned with applicable regulatory and audit requirements, including SAMA CSF and NCA ECC.\nTechnical Leadership & Mentorship\nAct as a senior technical escalation point for complex SIEM, detection, and CTI challenges.\nMentor junior SOC analysts and engineers, sharing knowledge and helping them develop their technical skills.\nMaintain clear technical documentation, runbooks, and playbooks.\nDrive continuous improvement across security operations, tooling, and processes.\nWhat you’ll bring:\n4-5 years of progressive experience in SOC operations, SIEM engineering, detection engineering, or cyber threat intelligence.\nStrong hands-on experience with Elastic Stack, including SIEM administration, architecture, ingestion pipelines, and performance optimisation.\nProven ability to develop complex detection rules, correlation logic, and behavioural detections.\nExperience with MITRE ATT&CK and detection coverage analysis.\nPractical experience with threat intelligence platforms such as Cyble, or equivalent tools.\nStrong understanding of incident investigation, incident management, and root cause analysis.\nExperience integrating logs from different sources, including cloud environments such as AWS and GCP.\nScripting and automation skills, preferably with Python.\nUnderstanding of fintech-related threats, including account takeover, payment fraud, API abuse, and mobile application threats.\nFamiliarity with security and regulatory frameworks such as SAMA CSF, NCA ECC, PDPL, and PCI DSS.\nStrong analytical, communication, documentation, and problem-solving skills.\nAbility to work independently, take ownership of complex technical challenges, and support the development of less experienced colleagues.\n Certifications: Relevant Elastic and GIAC certifications are required for this role under the internal job specification. CTI certifications are also expected; CISSP, CISM, or equivalent senior security certifications are an advantage.\nBenefits:\nWork on security challenges within a fast-growing fintech environment.\nTake ownership of security tooling and detection capabilities that protect real financial products and customer data.\nMake a direct impact on the maturity of our SOC and threat intelligence function.\nCollaborate with experienced security professionals and cross-functional engineering teams.","description_format":"text","description_chars":4994,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Buy Now, Pay Later"],"lifecycle":[{"event":"open","at":"2026-10-29T08:51:42Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":15,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/tabby-senior-engineer-information-security-soc","json_url":"https://alion.io/job/tabby-senior-engineer-information-security-soc.json","meta":{"generated_at":"2026-11-01T00:56:22Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1555,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":255},"rest":"https://alion.io/mcp/rest/get_company?id=255"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftabby-senior-engineer-information-security-soc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftabby-senior-engineer-information-security-soc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftabby-senior-engineer-information-security-soc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/tabby-senior-engineer-information-security-soc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftabby-senior-engineer-information-security-soc"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3447086}},{"tool":"search_jobs","arguments":{"company":"tabby.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3447086},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}