Analyst, Information Security (SOC)

Key Responsibilities

• Administer Tabby's Elastic SIEM deployment — monitoring platform health, index lifecycle management, cluster performance, and log ingestion rates to maintain continuous operational visibility across all connected log sources.
• Own the log source onboarding process — coordinating with IT, Cloud, DevOps, and application teams to integrate new assets into Elastic SIEM via syslog, API connectors, Beats agents, or custom parsers.
• Maintain and continuously improve Tabby's asset and log source inventory — tracking onboarding status, ingestion volumes, and coverage gaps, and escalating visibility deficiencies to the SOC Lead for prioritisation.
• Perform routine SIEM housekeeping — reviewing index health, managing retention policies, verifying that critical detection rules are active and firing correctly, and resolving parsing errors or dropped log sources promptly.
• Support SIEM tuning activities under senior guidance — adjusting field mappings, resolving ingest pipeline issues, and validating that log data is correctly normalised and queryable by the managed SOC team.
• Maintain SIEM configuration documentation — recording index patterns, log source integration specifications, agent deployment standards, and platform architecture notes.

• Serve as Tabby's internal point of contact for detection engineering — reviewing, testing, and formally approving correlation rules and use cases submitted by the managed SOC provider before production deployment.
• Validate detection logic submitted by the vendor — testing use cases against sample log data in a staging environment to confirm accuracy, alignment with Tabby's threat model, and false positive risk before go-live.
• Maintain Tabby's use case library — tracking all active, pending, and retired detection rules with their logic, use case ID, last review date, trigger frequency, and approval status.
• Monitor weekly use case performance reports from the managed SOC — flagging rules with high false positive rates, untriggered rules, or detection gaps for remediation with the vendor.
• Assist in developing Tabby-specific detection requirements for Fintech threats — translating business and regulatory risks (ATO, payment fraud, API abuse, credential stuffing) into detection use case specifications.
• Ensure detection coverage aligns with relevant frameworks — reviewing use case libraries against MITRE ATT&CK, SAMA CSF controls, and NCA ECC requirements.

• Administer and manage Tabby's Cyble CTI platform — maintaining platform configuration, user access, feed integrations, and API connectivity between Cyble and the Elastic SIEM environment.
• Monitor Cyble for emerging threat intelligence relevant to Tabby — tracking new threat actor TTPs, CVE disclosures targeting Tabby's technology stack, and Fintech-specific threats including ATO campaigns, payment fraud schemes, and mobile app threats.
• Manage Tabby's IOC registry — collecting, categorising, and maintaining accurate IOC entries (IP addresses, domains, file hashes, URLs) from Cyble and other feeds, with context, confidence levels, and expiry dates correctly recorded.
• Oversee IOC operationalisation — coordinating with the managed SOC team to ensure confirmed IOCs are ingested into Elastic SIEM detection rules within agreed timeframes, and tracking coverage confirmation.
• Monitor brand protection alerts via Cyble — reviewing findings for domain spoofing, counterfeit mobile applications, fake social media profiles, dark web data exposure, and leaked credentials; escalating confirmed threats per defined procedures.
• Prepare and distribute periodic CTI briefings — compiling notable intelligence findings, brand protection status, active IOC feeds, and sector-relevant threat trends for the SOC Lead and relevant stakeholders.

• Act as Tabby's primary internal liaison with the managed SOC service provider — reviewing daily alert summaries, weekly threat hunting reports, and monthly management reports submitted by the vendor.
• Validate vendor escalations — reviewing incidents escalated by the managed SOC to confirm sufficient investigation evidence, accurate severity classification, and completeness of remediation recommendations before internal action.
• Own Tabby's incident closure process — reviewing vendor-recommended closures, confirming remediation actions have been completed, ensuring evidence is properly documented, and formally closing incidents in the incident management system.
• Track managed SOC SLA performance — monitoring key metrics including escalation quality, threat hunting deliverable timeliness, and use case update frequency; flagging deviations to the SOC Lead.
• Maintain Tabby's incident register — ensuring the master incident log is accurate, current, and audit-ready in line with SAMA CSF and internal governance requirements.
• Participate in post-incident reviews — reviewing vendor post-incident reports, validating root cause analysis findings, and tracking agreed corrective actions to completion.

• Maintain SOC operational documentation — escalation records, tool status trackers, runbook libraries, and detection playbooks — ensuring records are accurate, current, and audit-ready.
• Support the preparation of SOC performance reports and metrics dashboards — compiling MTTD/MTTR statistics, SLA adherence data, IOC registry accuracy, and use case coverage metrics.
• Contribute to SOC process improvement initiatives — identifying gaps in detection coverage, tooling, or process and raising improvement recommendations to the SOC Lead.
• Actively invest in continuous self-development — studying SIEM administration, detection engineering, Cyble platform capabilities, and the MITRE ATT&CK framework to build independent expertise and progress toward the next grade.

Skills, Knowledge and Expertise

• Bachelor's degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, or a related field.
• Recent graduates and fresh university leavers are encouraged to apply — no prior professional SOC experience is required.
• Academic projects, home labs (e.g., TryHackMe Blue Team paths, HackTheBox, Elastic Stack builds), or internship experience in security operations or monitoring are viewed favorably.
• No mandatory professional experience required. Any internship, academic project, or personal lab experience related to security operations, log analysis, SIEM platforms, or threat intelligence is a strong advantage. Hands-on exposure to Elastic Stack, even in a self-study context, is a distinct advantage
• Foundational understanding of SIEM platforms — ability to navigate Elastic Stack (Kibana dashboards, KQL/Lucene queries, ES|QL) consoles to review alerts, investigate events, and query log data across multiple sources.
• Basic understanding of network security fundamentals — TCP/IP protocols, DNS, HTTP/S, common attack traffic patterns (port scans, brute force, C2 beaconing), and how they manifest in SIEM log sources.
• Foundational awareness of endpoint security monitoring — Windows Event Log analysis (logon events, process creation, registry changes), Linux syslog, and common persistence and lateral movement indicators.

Employment type

Full Time