Insider Threat & UEBA Resident Engineer (Everfox)

We are seeking an experienced Insider Threat & UEBA Resident Engineer to manage, administer, and optimize the client's Everfox insider threat monitoring environment. The role involves supporting EverInsight User and Entity Behavior Analytics (UEBA) and EverView platforms for approximately 22,000 users, along with the supporting Oracle database, QlikSense reporting environment, and Red Hat Enterprise Linux infrastructure. The successful candidate will be responsible for platform administration, behavioral analytics optimization, data source integration, insider threat investigation support, and ongoing operational maintenance. Key Responsibilities Administer, monitor, upgrade, and maintain Everfox EverInsight (UEBA) and EverView platforms. Manage endpoint agent deployment, monitoring, troubleshooting, and health across approximately 22,000 users. Develop and optimize behavioral analytics models, risk scoring mechanisms, detection indicators, and monitoring policies to improve threat detection and reduce false positives. Integrate and maintain data sources, including Active Directory, VPN, proxy, email, Data Loss Prevention (DLP), HR systems, and SIEM platforms. Support insider threat investigations in collaboration with SOC and investigation teams, including evidence collection, analysis, and case reporting. Administer and maintain Oracle Database Enterprise Edition, including performance optimization, partitioning, and backup operations. Support QlikSense dashboards, reporting, and data visualization requirements. Maintain and troubleshoot Red Hat Enterprise Linux (RHEL) servers supporting the insider threat environment. Integrate insider threat solutions with SIEM, SOAR, and IT Service Management (ITSM) platforms. Maintain operational documentation, standard operating procedures (SOPs), runbooks, and configuration baselines. Coordinate with Everfox technical support for incident resolution, product updates, patches, and escalations. Provide knowledge transfer and technical guidance to bank personnel. Prepare monthly reports covering insider risk, platform performance, operational activities, and investigation metrics. Required Qualifications and Skills Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline. Minimum 4 years of experience in security engineering, security operations, or SOC environments. At least 2 years of hands-on experience with insider threat management, UEBA, or DLP platforms. Practical experience with Everfox EverInsight and EverView, or their Forcepoint predecessors, including Forcepoint Insider Threat and Behavioral Analytics. Experience with comparable UEBA solutions, such as Exabeam, Securonix, Splunk UBA, or DTEX, will also be considered. Working knowledge of Red Hat Enterprise Linux administration. Experience with Oracle SQL and database administration, preferably Oracle Database Enterprise Edition. Familiarity with QlikSense or similar business intelligence and reporting tools. Understanding of insider threat detection, behavioral analytics, security monitoring, and investigation processes. Knowledge of applicable security and compliance frameworks, particularly Saudi Arabia's Personal Data Protection Law (PDPL), SAMA Cyber Security Framework (CSF), and National Cybersecurity Authority Essential Cybersecurity Controls (NCA ECC). Strong analytical, troubleshooting, documentation, and communication skills. Professional proficiency in English; Arabic language skills are an advantage. Preferred Certifications Everfox or Forcepoint product certifications. Red Hat Certified System Administrator (RHCSA). Oracle Certified Associate (OCA) or Oracle Certified Professional (OCP). CompTIA Security+ or CompTIA CySA+. Show more Show less