About the Role
We’re a rapidly scaling digital goods company, and security operations is a function you’ll shape, not just run. As our first Security Operations hire, you’ll own threat detection and incident response from start to finish: what we log, what we alert on, and how we respond when something happens. You’ll work closely with engineering and our Product Security function to protect our cloud-native platform, and you’ll improve our ability to spot and contain threats in ways we can measure. This is a high-impact role with plenty of autonomy. It suits someone who enjoys building security operations from first principles in a modern, fast-moving environment.
What You’ll Do
- Build and run core detection and response capabilities: Design and operate our security operations across cloud, identity, endpoint and SaaS, from threat detection and threat hunting through to incident response.
- Build security data pipelines: Design and build the pipelines that bring logs from cloud, identity, endpoint and SaaS sources into our SIEM or security data lake. Normalize and enrich the data at ingestion, monitor pipeline health so a broken log source is caught quickly, and balance coverage against cost and retention requirements.
- Own our security operations tooling: Select, deploy, configure and tune the SIEM, EDR, cloud threat detection and automation tooling so it raises alerts with a high signal to noise ratio.
- Build detections that matter: Write detections as code, map them to MITRE ATT&CK and base them on how attackers would realistically target our environment. Measure and test coverage, and focus effort where the risk is highest.
- Lead incident response: Own the incident response plan and playbooks. Act as incident commander for security events and coordinate containment and recovery across engineering, legal and leadership. Run blameless PIRs that leave us stronger.
Requirements
- Senior experience: Typically 5+ years in security operations, detection engineering or incident response, with hands-on experience building things yourself. A startup or scale-up background is a strong plus.
- Cloud detection and response ownership: You’ve built detections and investigated incidents in AWS, using sources like CloudTrail, GuardDuty, VPC Flow Logs and Kubernetes audit logs.
- Depth in key security operations domains: You’re comfortable taking the lead in at least one (ideally several) of these:
- Detection engineering and detection-as-code
- Incident response and cloud forensics
- SIEM and security data pipeline architecture
- Security automation (SOAR) and alert triage workflows
- Threat hunting and threat intelligence
- Engineering mindset: You write code (Python, SQL or your SIEM’s query language), treat detections and runbooks like software, and automate repetitive work so people can focus on judgment calls.
- Calm, clear communication under pressure: You can run an incident and keep stakeholders informed while it’s happening. You can turn technical findings into statements of impact and next steps for engineers, leadership, non-technical colleagues and, when needed, customers.
Nice to Have
- Experience building the incident response and logging controls needed for SOC 2, ISO 27001 or PCI audits
- Experience managing an MDR or MSSP partner
- Familiarity with breach notification obligations (e.g. UAE PDPL, customer contractual SLAs)
- Experience hiring or mentoring security analysts or engineers as a function grows
If you’ve ever looked at a wall of untuned alerts and thought, “I could build a detection and response program that actually catches things,” this is your chance to do it.
Benefits
- Immediate, large-scale impact on a high-growth business
- Top-of-the-market compensation packages
- Work alongside top regional talent, with team members from Talabat, Careem, Etisalat, and more