Cyber Defense Operations Supervisor

Position: Cyber Defense Operations Supervisor Location: Riyadh, Saudi Arabia (Only candidates based in Riyadh would be preferred) Contract Duration: As soon as possible - 28th Feb 2027 ( 4 months contract) About the Role We are seeking an experienced Cybersecurity Defense Supervisor to oversee day-to-day cybersecurity defense operations for a major football event project in Saudi Arabia. The role will supervise security monitoring, incident response, threat detection, vulnerability management, and operational activities supporting the organization's 24/7 Security Operations Center (SOC). The successful candidate will ensure that security monitoring and response activities are delivered effectively, incidents are handled and escalated promptly, and cybersecurity defense operations remain prepared to support the heightened security requirements of a major international football event in KSA. Working closely with the Cybersecurity Defense Manager and relevant technical teams, the Supervisor will coordinate operational activities, guide security analysts, monitor performance, and support continuous improvements in the organization's cybersecurity defense capabilities Key Responsibilities 1. Security Operations Center (SOC) Supervision • Supervise day-to-day SOC activities, ensuring continuous security monitoring and timely handling of security alerts and incidents. • Coordinate SOC shift coverage, workload distribution, task allocation, and operational handovers to support 24/7 monitoring requirements. • Monitor the effectiveness of security monitoring processes, escalation procedures, and operational workflows. • Provide technical guidance to SOC analysts and ensure alerts are investigated, documented, and escalated appropriately. • Support the effective use and ongoing optimization of SIEM, SOAR, and other security monitoring tools. • Ensure critical systems and applications are appropriately integrated into security monitoring through effective log source onboarding and security telemetry collection. • Maintain operational documentation, shift reports, incident records, and security monitoring procedures. 2. Incident Response and Coordination • Coordinate the initial assessment, investigation, containment, and escalation of cybersecurity incidents in accordance with established procedures. • Ensure incident response playbooks and escalation procedures are followed and updated as required. • Support incident response exercises, tabletop exercises, and operational readiness activities. • Coordinate with relevant technical teams, IT, vendors, and other stakeholders to facilitate timely incident investigation and resolution. • Escalate major or critical cybersecurity incidents to the Cybersecurity Defense Manager and support incident command and response activities as directed. • Track incident status, response actions, outstanding issues, and lessons learned to support continuous improvement. • Ensure incident documentation and post-incident reports are completed accurately and promptly. 3. Threat Detection and Intelligence • Supervise security monitoring activities to identify suspicious behavior, emerging threats, and potential security incidents. • Support the integration of relevant threat intelligence into security monitoring, detection rules, and investigation procedures. • Coordinate with SOC analysts and technical teams to improve detection use cases and investigate potential threats. • Monitor detection coverage and identify gaps in security monitoring or alerting capabilities. • Support the tuning and optimization of detection rules to improve alert quality and reduce false positives. • Escalate significant threat developments and emerging risks to the Cybersecurity Defense Manager. 4. Vulnerability Management and Security Controls • Coordinate vulnerability identification, assessment, prioritization, and remediation tracking in line with established risk criteria and remediation timelines. • Monitor vulnerability remediation progress and follow up with system owners and technical teams on outstanding issues. • Support penetration testing activities by coordinating findings, tracking remediation actions, and verifying closure evidence. • Assist in monitoring the effectiveness of cybersecurity defense controls across network security, endpoint security, identity and access management, and cryptographic controls. • Escalate critical vulnerabilities, overdue remediation actions, and significant control weaknesses to the Cybersecurity Defense Manager. • Maintain accurate vulnerability records, remediation status reports, and supporting documentation. 5. Security Tools, Logging, and Operational Performance • Monitor the operational effectiveness and availability of security monitoring tools, including SIEM and SOAR platforms. • Coordinate log source onboarding and verify that critical systems provide the security telemetry required for effective detection and investigation. • Support the implementation of security event logging, retention, and monitoring requirements. • Track and report operational KPIs, including Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), detection coverage, incident volumes, incident severity, and vulnerability remediation status. • Prepare regular SOC activity reports, incident summaries, and operational performance updates for management review. • Identify operational gaps and recommend improvements to detection, response, tooling, and incident handling processes. 6. Major Event Cybersecurity Readiness • Support cybersecurity operational readiness activities ahead of the tournament, ensuring monitoring processes, escalation paths, and response procedures are tested and understood. • Coordinate enhanced security monitoring, shift arrangements, and operational readiness during the live event window. • Support security war-room activities and coordinate incident information with relevant cybersecurity, IT, venue operations, facilities/security teams, and service providers. • Monitor event-related cybersecurity alerts and escalate significant threats or incidents in accordance with established procedures. • Support contingency planning, incident simulations, and surge operational arrangements for periods of heightened cyber risk. • Maintain clear communication and operational handovers throughout match days and other critical event periods. 7. Team Coordination and Stakeholder Management • Provide day-to-day supervision, technical guidance, and operational support to SOC analysts and other cybersecurity defense personnel. • Monitor task completion, adherence to procedures, and the quality of incident investigations and documentation. • Coordinate operational dependencies with IT, cybersecurity architecture, infrastructure teams, vendors, and other relevant stakeholders. • Work closely with the Cybersecurity Architecture Manager to ensure new systems and solutions have appropriate security monitoring and detection capabilities before go-live. • Maintain clear escalation channels and communicate operational risks, incidents, and outstanding actions to the Cybersecurity Defense Manager. • Contribute to the development of team capabilities, operational procedures, and continuous improvement initiatives.