Senior Security Event Correlation Specialist

Job Title: Senior Security Event Correlation Specialist

Location: United Arab Emirates (Remote)

Employment Type: Full-Time

Work Arrangement: 100% Remote — Work From Home

Level: Senior

About the Role

We are seeking an experienced Senior Security Event Correlation Specialist to strengthen cybersecurity monitoring, threat detection, and security incident analysis across enterprise IT environments. The role focuses on correlating security events from multiple sources, identifying suspicious activity, developing detection logic, investigating potential threats, and improving the effectiveness of Security Information and Event Management (SIEM) capabilities.

The successful candidate will collaborate remotely with security operations, threat intelligence, incident response, infrastructure, and governance teams to improve threat visibility and reduce organizational cyber risk. This position requires advanced analytical skills, knowledge of security monitoring technologies, and the ability to interpret complex event patterns in a fully remote environment.

Key Responsibilities

• Analyze and correlate security events collected from endpoints, servers, firewalls, network devices, cloud platforms, and business applications.
• Develop, maintain, and optimize SIEM correlation rules, detection logic, alert thresholds, and monitoring use cases.
• Investigate suspicious event patterns, authentication anomalies, privilege escalation indicators, and unusual network activity.
• Identify relationships between seemingly unrelated security events to detect coordinated attacks and advanced threats.
• Monitor security alerts and investigate potential incidents using authorized SIEM, endpoint detection and response (EDR), and extended detection and response (XDR) platforms.
• Develop detection use cases aligned with MITRE ATT&CK tactics, techniques, and procedures.
• Analyze log sources and assess the completeness, quality, and reliability of security telemetry.
• Review event normalization, parsing, enrichment, and correlation processes to improve detection accuracy.
• Reduce false-positive alerts through rule tuning, contextual enrichment, and behavioral analysis.
• Support threat hunting activities by identifying patterns associated with malware, lateral movement, data exfiltration, and unauthorized access.
• Correlate identity and access events to identify suspicious account activity and potential credential compromise.
• Review cloud security events, network traffic indicators, endpoint telemetry, and application logs for potential threats.
• Coordinate with incident response teams to provide investigation findings, timelines, indicators of compromise, and supporting evidence.
• Maintain detailed investigation records, detection rule documentation, escalation reports, and audit trails.
• Monitor threat intelligence feeds and incorporate relevant indicators and detection recommendations into security monitoring processes.
• Support the development of automated detection and response workflows in coordination with authorized security engineering teams.
• Evaluate SIEM performance, event ingestion coverage, detection effectiveness, and monitoring service-level indicators.
• Participate in security incident reviews and recommend improvements to detection coverage and event correlation capabilities.
• Prepare technical reports covering security trends, alert patterns, incident indicators, and emerging threat activity.
• Provide technical guidance to junior security analysts and support continuous improvement of security operations.

Qualifications and Experience

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Security, or a related discipline.
• Typically 5–8 years of experience in security operations, SIEM engineering, threat detection, security analytics, or incident investigation.
• Strong understanding of security event correlation, log analysis, threat detection, and incident monitoring principles.
• Practical experience with SIEM platforms such as Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel, ArcSight, or similar solutions.
• Knowledge of EDR and XDR platforms, endpoint telemetry, network security monitoring, and cloud security logging.
• Experience developing correlation rules, detection queries, alert logic, and security monitoring use cases.
• Understanding of common attack techniques, cyber threat indicators, and adversary behavior.
• Familiarity with the MITRE ATT&CK framework and common threat intelligence methodologies.
• Knowledge of authentication protocols, identity management, network protocols, firewalls, and endpoint security controls.
• Experience analyzing Windows, Linux, cloud, application, and network security logs.
• Familiarity with scripting and query languages such as Python, PowerShell, SQL, KQL, or SPL.
• Understanding of incident response processes, digital evidence handling, and investigation documentation.
• Knowledge of security frameworks and standards such as ISO 27001, NIST Cybersecurity Framework, and CIS Controls.
• Strong analytical thinking, problem-solving, and technical report-writing skills.
• Excellent communication and collaboration abilities in multidisciplinary remote security teams.
• Relevant certifications such as CISSP, GCIH, GCIA, GCDA, Splunk certifications, Microsoft Security certifications, or equivalent credentials are advantageous.

What We Offer

• A fully remote, work-from-home position based in the UAE.
• Opportunities to contribute to enterprise cybersecurity monitoring and threat detection initiatives.
• Collaboration with experienced security operations and infrastructure professionals.
• Exposure to advanced SIEM, threat intelligence, and security analytics technologies.
• Professional development and opportunities for career advancement.

How to Apply

Interested candidates should submit an updated CV highlighting their SIEM experience, security event correlation expertise, threat detection capabilities, incident investigation background, and relevant cybersecurity certifications.

Application Subject: Application – Senior Security Event Correlation Specialist (UAE Remote)

Candidates should confirm applicable employment arrangements, residency requirements, and work authorization before accepting an offer.

• Remote-work scope and authorization: This position focuses on remote security monitoring, event correlation, threat analysis, detection engineering, and investigation support using authorized digital access. Physical infrastructure inspections, hardware handling, and on-site security testing must be performed by qualified local personnel. Live production changes, privileged security administration, penetration testing, incident containment, forensic evidence acquisition requiring physical access, regulatory notifications, formal compliance attestations, and material cybersecurity risk acceptance must be performed or authorized by appropriately qualified and designated security, legal, or compliance professionals under approved procedures.