Senior Security Event Correlation Specialist

Job Title: Senior Security Event Correlation Specialist Location: UAE (Remote) Employment Type: Full-Time Work Arrangement: Fully Remote — 100% Work From Home Level: Senior About Us We are seeking an experienced Senior Security Event Correlation Specialist to strengthen our cybersecurity monitoring, threat detection, and security incident response capabilities. The successful candidate will analyze security events from multiple systems, identify suspicious activity, correlate threat indicators, and develop effective detection strategies to protect enterprise infrastructure and sensitive information. This fully remote role requires strong expertise in Security Information and Event Management (SIEM), threat hunting, security analytics, incident investigation, and detection engineering. The ideal candidate will be comfortable working independently while collaborating with security operations, infrastructure, cloud, and incident response teams. Key Responsibilities Monitor, analyze, and correlate security events from endpoints, servers, network devices, firewalls, identity platforms, cloud environments, and security applications. Develop, maintain, and optimize SIEM correlation rules, detection logic, alert thresholds, and security monitoring use cases. Analyze event patterns and identify suspicious behavior, attack indicators, unauthorized access, privilege escalation, and potential security breaches. Administer and optimize SIEM platforms such as Microsoft Sentinel, Splunk Enterprise Security, IBM QRadar, or equivalent technologies. Integrate security log sources and ensure reliable event ingestion, normalization, parsing, enrichment, and correlation. Develop detection rules using appropriate query languages, including SPL, Kusto Query Language (KQL), or other platform-specific languages. Investigate complex security alerts by correlating events across multiple data sources and establishing timelines of suspicious activity. Perform threat hunting using threat intelligence, behavioral analytics, indicators of compromise, and adversary tactics, techniques, and procedures. Map detection capabilities to frameworks such as MITRE ATT&CK and identify gaps in existing security monitoring coverage. Reduce false positives by tuning correlation rules, refining detection thresholds, and improving alert context. Enrich security events with threat intelligence, asset information, identity context, and vulnerability data to improve investigation quality. Collaborate with SOC analysts, incident responders, threat intelligence specialists, and cybersecurity engineers to investigate and contain security threats. Support the development and maintenance of automated security workflows and SOAR playbooks to improve detection and response efficiency. Analyze security telemetry to identify emerging attack patterns, persistent threats, lateral movement, and suspicious authentication behavior. Conduct root-cause analysis of significant security incidents and recommend improvements to detection logic and monitoring coverage. Maintain documentation for correlation rules, log sources, detection use cases, incident investigation procedures, and operational standards. Monitor SIEM platform performance, data ingestion health, event retention, and detection pipeline reliability. Support vulnerability management, security assessments, audit activities, and continuous improvement initiatives. Ensure security monitoring practices comply with organizational policies, applicable UAE regulatory requirements, privacy obligations, and data protection standards. Prepare reports on detection effectiveness, alert volumes, incident trends, monitoring coverage, and security operations performance. Provide technical guidance to junior security analysts and contribute to detection engineering standards and knowledge sharing. Perform security monitoring, analysis, investigation, and collaboration remotely through approved and secure enterprise platforms. Qualifications and Experience Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Security, or a related discipline. At least 5–8 years of experience in security operations, SIEM engineering, threat detection, security analytics, or incident investigation. Strong hands-on experience with enterprise SIEM platforms such as Microsoft Sentinel, Splunk Enterprise Security, IBM QRadar, or comparable solutions. Demonstrated experience developing and tuning correlation rules, detection queries, alert logic, and security monitoring use cases. Strong understanding of network security, endpoint protection, identity and access management, authentication protocols, and cloud security. Experience analyzing logs from Windows and Linux systems, firewalls, intrusion detection systems, EDR platforms, identity providers, and cloud services. Proficiency in relevant query languages, such as KQL or SPL, and familiarity with scripting languages such as Python or PowerShell. Knowledge of common cyberattack techniques, including phishing, credential theft, malware activity, lateral movement, command-and-control communications, and privilege escalation. Familiarity with MITRE ATT&CK, cyber threat intelligence, indicators of compromise, and behavioral detection methodologies. Experience with SOAR platforms, automated incident response workflows, and security alert enrichment is an advantage. Understanding of incident response processes, digital forensics fundamentals, threat hunting, and root-cause analysis. Knowledge of log management, event normalization, data retention, time synchronization, and SIEM performance optimization. Familiarity with relevant UAE cybersecurity frameworks, industry standards, and regulatory expectations. Strong analytical, problem-solving, documentation, and communication skills. Ability to prioritize security events, investigate complex technical issues, and work effectively under pressure. Relevant certifications such as Splunk certifications, Microsoft Security certifications, GIAC security certifications, CompTIA CySA+, or CISSP are an advantage. Ability to work independently in a fully remote environment while coordinating with geographically distributed security teams. Reliable internet connectivity and a secure home-working environment suitable for confidential security operations. Key Performance Indicators (KPIs) Detection Effectiveness: Improve the identification of genuine security threats through accurate correlation rules and detection use cases. False Positive Reduction: Reduce unnecessary alerts through continuous tuning and improved event enrichment. Investigation Efficiency: Improve the speed and quality of security event analysis and investigation. SIEM Reliability: Maintain effective log ingestion, data normalization, monitoring coverage, and platform performance. Threat Coverage: Expand detection coverage across critical assets, identities, networks, endpoints, and cloud environments. Incident Support: Contribute to timely incident escalation, investigation, and containment. Detection Engineering: Regularly improve detection logic, rule documentation, and threat-hunting capabilities. Compliance and Reporting: Maintain accurate records and support applicable security governance requirements. Operational Improvement: Increase automation, reduce repetitive analysis, and improve security monitoring efficiency. Remote Productivity: Meet agreed operational targets while maintaining security, confidentiality, and accountability in a fully remote setting. What We Offer Competitive compensation based on qualifications and technical experience. 100% remote work with no routine office attendance required. Opportunities to work with enterprise cybersecurity platforms and advanced threat detection technologies. Professional development and access to relevant technical training and certifications. A collaborative, security-focused, and technology-driven working environment. Opportunities to contribute