Senior Security Event Correlation Specialist

Job Title: Senior Security Event Correlation Specialist

Location: United Arab Emirates (Remote)

Employment Type: Full-Time

Work Arrangement: 100% Remote — Work From Home

Level: Senior

About the Role

We are seeking an experienced Senior Security Event Correlation Specialist to design, manage, and optimize security event correlation processes across enterprise IT environments. This fully remote role focuses on analyzing security telemetry, identifying relationships between seemingly unrelated events, detecting suspicious activity, and improving threat detection capabilities through Security Information and Event Management (SIEM) platforms and related security technologies.

The successful candidate will work closely with Security Operations Center (SOC) analysts, incident responders, threat intelligence teams, infrastructure specialists, and cybersecurity leadership to improve detection accuracy, reduce alert noise, and strengthen the organization's security monitoring capabilities.

Key Responsibilities

• Design, develop, and maintain security event correlation rules across enterprise security monitoring platforms.
• Analyze security logs and telemetry from endpoints, servers, networks, cloud environments, identity systems, and business applications.
• Develop correlation logic to identify suspicious patterns, attack sequences, and indicators of compromise.
• Configure and optimize SIEM detection rules, analytics, alerts, dashboards, and monitoring workflows.
• Correlate events across multiple data sources to identify complex threats and potentially coordinated malicious activity.
• Investigate anomalous event patterns, authentication irregularities, privilege escalation, lateral movement, and unusual network behavior.
• Map detection use cases to recognized cybersecurity frameworks and adversary techniques, including MITRE ATT&CK.
• Collaborate with SOC analysts to validate alerts, improve investigation workflows, and refine escalation criteria.
• Review false positives, missed detections, and alert fatigue to improve detection precision and operational efficiency.
• Develop detection content for malware activity, phishing campaigns, account compromise, insider threats, and other relevant attack scenarios.
• Analyze event normalization, parsing, enrichment, and data quality issues affecting correlation accuracy.
• Integrate threat intelligence feeds and contextual information into event correlation and detection processes.
• Develop automated enrichment and response workflows in coordination with security engineering teams.
• Monitor security event coverage and identify gaps in logging, telemetry collection, and detection capabilities.
• Conduct retrospective analysis of security events to identify previously undetected threats or suspicious activity.
• Support incident investigations by providing correlated event timelines, technical findings, and supporting evidence.
• Maintain detection engineering documentation, correlation rule inventories, tuning records, and operational procedures.
• Coordinate with infrastructure and application teams to improve log collection and security monitoring coverage.
• Evaluate emerging threats and translate relevant attack techniques into practical detection use cases.
• Support threat-hunting activities through advanced event analysis and hypothesis-driven investigations.
• Prepare reports on detection effectiveness, alert trends, correlation performance, and security monitoring maturity.
• Participate in security monitoring assessments, control reviews, and continuous improvement initiatives.

Qualifications and Experience

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Network Security, or a related discipline.
• Significant professional experience in security event analysis, SIEM engineering, detection engineering, or security operations.
• Strong understanding of SIEM platforms such as Splunk Enterprise Security, Microsoft Sentinel, IBM QRadar, ArcSight, or equivalent technologies.
• Experience developing and tuning correlation rules, detection logic, analytics, and alert conditions.
• Knowledge of security log formats, event normalization, parsing, enrichment, and centralized logging architectures.
• Understanding of network protocols, endpoint security, identity management, authentication systems, and cloud security telemetry.
• Experience analyzing Windows Event Logs, Linux system logs, firewall records, proxy logs, DNS events, and endpoint detection telemetry.
• Knowledge of common cyberattack techniques, including phishing, credential compromise, privilege escalation, persistence, and lateral movement.
• Familiarity with MITRE ATT&CK, the Cyber Kill Chain, and established threat detection methodologies.
• Experience with threat intelligence integration and indicator-based detection.
• Understanding of incident response processes, digital forensic principles, and security investigation workflows.
• Familiarity with SOAR platforms, automation playbooks, and security orchestration processes.
• Ability to write and troubleshoot complex detection queries using relevant SIEM query languages.
• Scripting experience with Python, PowerShell, or similar languages is advantageous.
• Strong analytical thinking, pattern recognition, and root-cause investigation skills.
• Excellent technical documentation and communication abilities.
• Ability to collaborate with geographically distributed SOC and cybersecurity teams.
• Relevant certifications such as Splunk, Microsoft Security, GIAC, or other recognized cybersecurity credentials are advantageous.

What We Offer

• Fully remote, work-from-home employment arrangement within the UAE-based role framework.
• Opportunity to work with enterprise security monitoring and advanced threat detection technologies.
• Collaboration with experienced SOC, incident response, threat intelligence, and security engineering teams.
• Professional development and exposure to evolving cybersecurity threats and detection methodologies.
• A technically challenging environment focused on security resilience, analytical excellence, and continuous improvement.

How to Apply

Interested candidates should submit an updated CV highlighting their experience in SIEM platforms, security event correlation, detection engineering, threat analysis, and cybersecurity operations.

Application Subject: Application – Senior Security Event Correlation Specialist (UAE Remote)

Candidates should confirm applicable employment arrangements, residency requirements, and work authorization before accepting an offer.

• Important scope clarification: This position is designed for 100% remote security monitoring, event analysis, detection engineering, incident investigation support, documentation, and virtual coordination. Physical infrastructure access, hardware interventions, and on-site security assessments must be performed by appropriately qualified local personnel. Production security changes, incident containment actions, and activities affecting critical systems must follow approved change-management procedures and applicable access authorization requirements.