Senior Security Operations Engineer

About the Role We’re a rapidly scaling digital goods company, and security operations is a function you’ll shape, not just run. As our first Security Operations hire, you’ll own threat detection and incident response from start to finish: what we log, what we alert on, and how we respond when something happens. You’ll work closely with engineering and our Product Security function to protect our cloud-native platform, and you’ll improve our ability to spot and contain threats in ways we can measure. This is a high-impact role with plenty of autonomy. It suits someone who enjoys building security operations from first principles in a modern, fast-moving environment. What You’ll Do - Build and run core detection and response capabilities: Design and operate our security operations across cloud, identity, endpoint and SaaS, from threat detection and threat hunting through to incident response. - Build security data pipelines: Design and build the pipelines that bring logs from cloud, identity, endpoint and SaaS sources into our SIEM or security data lake. Normalize and enrich the data at ingestion, monitor pipeline health so a broken log source is caught quickly, and balance coverage against cost and retention requirements. - Own our security operations tooling: Select, deploy, configure and tune the SIEM, EDR, cloud threat detection and automation tooling so it raises alerts with a high signal to noise ratio. - Build detections that matter: Write detections as code, map them to MITRE ATT&CK and base them on how attackers would realistically target our environment. Measure and test coverage, and focus effort where the risk is highest. - Lead incident response: Own the incident response plan and playbooks. Act as incident commander for security events and coordinate containment and recovery across engineering, legal and leadership. Run blameless PIRs that leave us stronger. Benefits - Immediate, large-scale impact on a high-growth business - Top-of-the-market compensation packages - Work alongside top regional talent, with team members from Talabat, Careem, Etisalat, and more

Build and run core detection and response capabilities across cloud, identity, endpoint and SaaS; design and operate security operations from threat detection through incident response. Build security data pipelines bringing logs into SIEM or security data lake, normalize/enrich data, monitor pipeline health. Own security operations tooling (SIEM, EDR, cloud threat detection, automation) to achieve high signal-to-noise. Write detections as code mapped to MITRE ATT&CK, measure coverage, focus on high-risk areas. Lead incident response, own incident response plan and playbooks, act as incident commander, coordinate containment and recovery across engineering, legal and leadership, and conduct blameless post-incident reviews.