SOC Analyst - Cyber Defense Centre

Embark on a journey where your unique contributions are celebrated, and your professional growth is embraced. At ADCB, we nurture a diverse, inclusive community where every voice is valued. About the business area GBS is a group of highly skilled and talented professionals who form an essential part of ADCB's continued journey of success. With a proud history of commitment, innovation and delivery, GBS constantly strives for excellence whilst ensuring the highest standards of quality and risk awareness. Each and every member of the GBS family plays an integral role in driving ADCB's strategy, growth and digital evolution by working closely with our valued business partners to achieve exceptional customer experience through our outstanding service and support. We are actively seeking an ambitious professional to join our Group Business Service team at ADCB to work alongside passionate colleagues who share your ambition to redefine excellence in UAE banking. In this role, your key responsibilities include: The SOC Analyst is responsible for continuous cyber security monitoring, analysis and investigation of real-time and historical security events to identify anomalies, policy violations, cyber risks and security incidents. The role conducts incident triage and forensic analysis, coordinates response and remediation activities, and manages cyber security incidents through to closure. The analyst supports the continuous protection of information systems and IT infrastructure through effective use of SIEM, SOAR, data leakage monitoring, email security analysis and other security technologies. Security Monitoring, Detection & Analysis Perform day-to-day operational security monitoring and analyze real-time and historical events from SIEM and other security platforms. Identify security anomalies, suspicious activities, control or policy violations, indicators of compromise and potential cyber security risks. Validate and triage alerts, correlate events from multiple data sources and distinguish genuine incidents from false positives. Monitor data leakage indicators and support investigation of suspected data loss or unauthorized information transfer. Analyze phishing, malicious and suspicious emails, including URLs, attachments, headers and other indicators, and coordinate required containment actions. Cyber Security Incident Response & Forensics Raise, classify, prioritize, investigate and manage cyber security incidents in accordance with established incident management procedures. Conduct forensic analysis and evidence review to determine incident scope, impact, root cause, attack path and affected assets where applicable. Coordinate containment, remediation, recovery and follow-up actions with infrastructure, application, network, endpoint and other relevant teams. Maintain complete incident records, investigation notes, evidence references, actions, decisions and closure documentation. Provide timely updates on day-to-day security activities and advise relevant stakeholders of incidents, risks, status and required actions. Provide and seek responses to queries related to security incidents, ensuring effective communication and timely resolution. SIEM, SOAR & Security Operations Support Use Security Information and Event Management (SIEM) platforms for event monitoring, correlation, investigation and security incident detection. Use Security Orchestration, Automation and Response (SOAR) platforms to manage incident workflows, case handling, enrichment, escalation and response activities. Support security operations processes and security technologies to maintain continuous protection of information systems and IT infrastructure. Identify opportunities to improve detection logic, operational workflows, automation and response efficiency. Stakeholder Coordination, Changes & Threat Advisory Liaise with internal teams and relevant stakeholders to exchange information related to security incidents and obtain required technical or business inputs. Initiate or request changes arising from security incidents and coordinate with responsible teams to implement preventive and mitigation controls. Provide and seek advisory on emerging cyber threats, attack techniques and observed security trends relevant to the environment. Work closely with infrastructure and SOC teams to deploy preventive, detective and mitigation controls based on investigation findings and identified risks. Reporting, Metrics & Control Improvement Analyze operational data and prepare daily, weekly and monthly security reports documenting incidents, security threats, trends, response status and key observations. Maintain accurate security operations metrics and measurement records, including relevant Key Risk Indicators (KRIs). Use metrics and trend analysis to identify weaknesses in controls, recurring issues and areas requiring remediation or improvement. Track agreed remediation actions and support continuous improvement of SOC monitoring, incident

The SOC Analyst is responsible for continuous cyber security monitoring, analysis and investigation of real-time and historical security events to identify anomalies, policy violations, cyber risks and security incidents. The role conducts incident triage and forensic analysis, coordinates response and remediation activities, and manages cyber security incidents through to closure. The analyst supports the continuous protection of information systems and IT infrastructure through effective use of SIEM, SOAR, data leakage monitoring, email security analysis and other security technologies. "Security Monitoring, Detection & Analysis" Perform day-to-day operational security monitoring and analyze real-time and historical events from SIEM and other security platforms. Identify security anomalies, suspicious activities, control or policy violations, indicators of compromise and potential cyber security risks. Validate and triage alerts, correlate events from multiple data sources and distinguish genuine incidents from false positives. Monitor data leakage indicators and support investigation of suspected data loss or unauthorized information transfer. Analyze phishing, malicious and suspicious emails, including URLs, attachments, headers and other indicators, and coordinate required containment actions. "Cyber Security Incident Response & Forensics" Raise, classify, prioritize, investigate and manage cyber security incidents in accordance with established incident management procedures. Conduct forensic analysis and evidence review to determine incident scope, impact, root cause, attack path and affected assets where applicable. Coordinate containment, remediation, recovery and follow-up actions with infrastructure, application, network, endpoint and other relevant teams. Maintain complete incident records, investigation notes, evidence references, actions, decisions and closure documentation. Provide timely updates on day-to-day security activities and advise relevant stakeholders of incidents, risks, status and required actions. Provide and seek responses to queries related to security incidents, ensuring effective communication and timely resolution. "SIEM, SOAR & Security Operations Support" Use Security Information and Event Management (SIEM) platforms for event monitoring, correlation, investigation and security incident detection. Use Security Orchestration, Automation and Response (SOAR) platforms to manage incident workflows, case handling, enrichment, escalation and response activities. Support security operations processes and security technologies to maintain continuous protection of information systems and IT infrastructure. Identify opportunities to improve detection logic, operational workflows, automation and response efficiency. "Stakeholder Coordination, Changes & Threat Advisory" Liaise with internal teams and relevant stakeholders to exchange information related to security incidents and obtain required technical or business inputs. Initiate or request changes arising from security incidents and coordinate with responsible teams to implement preventive and mitigation controls. Provide and seek advisory on emerging cyber threats, attack techniques and observed security trends relevant to the environment. Work closely with infrastructure and SOC teams to deploy preventive, detective and mitigation controls based on investigation findings and identified risks. "Reporting, Metrics & Control Improvement" Analyze operational data and prepare daily, weekly and monthly security reports documenting incidents, security threats, trends, response status and key observations. Maintain accurate security operations metrics and measurement records, including relevant Key Risk Indicators (KRIs). Use metrics and trend analysis to identify weaknesses in controls, recurring issues and areas requiring remediation or improvement. Track agreed remediation actions and support continuous improvement of SOC monitoring, incident