Senior Security Event Correlation Specialist

Job Title: Senior Security Event Correlation Specialist

Location: United Arab Emirates (Remote)

Employment Type: Full-Time

Work Arrangement: 100% Remote — Work From Home

Level: Senior

About the Role

We are seeking an experienced Senior Security Event Correlation Specialist to support the monitoring, analysis, correlation, and investigation of cybersecurity events across enterprise IT environments. This role focuses on identifying suspicious activity, analyzing security alerts, correlating data from multiple security technologies, detecting potential threats, and strengthening security monitoring capabilities.

The successful candidate will work remotely with security operations, incident response, infrastructure, network, and threat intelligence teams to identify potential security incidents, assess risks, and improve detection effectiveness. The position is fully remote and requires strong expertise in security information and event management (SIEM), threat detection, log analysis, and security event correlation.

Key Responsibilities

• Monitor and analyze security events collected from enterprise networks, endpoints, servers, applications, cloud platforms, and other technology environments.
• Develop, maintain, and optimize security event correlation rules, detection logic, and monitoring use cases.
• Analyze alerts and event patterns to identify suspicious behavior, potential threats, and indicators of compromise.
• Correlate security information from multiple sources, including SIEM platforms, endpoint detection and response (EDR) tools, intrusion detection systems, firewalls, identity platforms, and threat intelligence feeds.
• Investigate complex security alerts by reviewing event timelines, authentication records, network traffic indicators, and system logs.
• Identify relationships between seemingly unrelated events to detect coordinated attacks, lateral movement, privilege escalation, and unusual access patterns.
• Support the development and refinement of detection strategies aligned with recognized cybersecurity frameworks and threat models.
• Review alert quality, detection coverage, false-positive rates, and event escalation procedures.
• Conduct threat hunting activities using available security telemetry, behavioral indicators, and historical event data.
• Collaborate with incident response teams to provide investigation findings, supporting evidence, and event correlation analysis.
• Support the mapping of detection rules and security events to relevant MITRE ATT&CK techniques and tactics.
• Analyze security monitoring gaps and recommend improvements to logging, data collection, detection logic, and alert prioritization.
• Review security incident reports and contribute to root cause analysis and corrective action recommendations.
• Maintain accurate investigation records, detection documentation, correlation rule inventories, and operational procedures.
• Prepare security monitoring reports, trend analyses, threat summaries, and management dashboards.
• Support security operations audits, detection validation exercises, and continuous improvement initiatives.
• Monitor emerging cyber threats, attack techniques, vulnerabilities, and security intelligence developments.

Qualifications and Experience

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Security, or a related discipline.
• Significant experience in security event monitoring, SIEM engineering, threat detection, security operations, or cybersecurity analysis.
• Strong understanding of security event correlation, log management, threat detection methodologies, and incident investigation.
• Hands-on experience with SIEM platforms such as Splunk Enterprise Security, Microsoft Sentinel, IBM QRadar, ArcSight, or equivalent solutions.
• Knowledge of endpoint detection and response, network security monitoring, intrusion detection, firewalls, identity security, and cloud security telemetry.
• Experience developing correlation rules, detection use cases, alert logic, and automated security monitoring workflows.
• Familiarity with query languages and analytical tools such as SPL, KQL, SQL, Python, or similar technologies.
• Strong understanding of common attack techniques, security vulnerabilities, authentication anomalies, and indicators of compromise.
• Knowledge of MITRE ATT&CK, incident response methodologies, and relevant cybersecurity frameworks.
• Experience analyzing large volumes of security logs and identifying meaningful behavioral patterns.
• Strong analytical, investigative, and problem-solving capabilities.
• Excellent technical documentation, communication, and stakeholder coordination skills.
• Ability to handle sensitive security information with discretion and maintain accurate investigation records.
• Ability to work independently and collaborate effectively with distributed security teams in a fully remote environment.
• Relevant certifications such as CISSP, GCIA, GCIH, CompTIA CySA+, Splunk certifications, or Microsoft Security certifications are advantageous.

What We Offer

• 100% remote working arrangement with work-from-home flexibility.
• Full-time professional opportunity in cybersecurity monitoring and threat detection.
• Exposure to enterprise SIEM platforms, advanced detection technologies, and security analytics.
• Opportunities to contribute to threat detection improvements and security operations maturity.
• Collaboration with multidisciplinary cybersecurity, infrastructure, network, and incident response teams.
• Professional development and opportunities to expand specialist cybersecurity expertise.

How to Apply

Interested candidates should submit an updated CV highlighting their security event correlation experience, SIEM expertise, threat detection capabilities, and relevant professional certifications.

Application Subject: Application – Senior Security Event Correlation Specialist (UAE Remote)

Candidates should confirm applicable employment arrangements, residency requirements, and work authorization before accepting an offer.

• Security and authorization note: This position focuses on remote security event analysis, SIEM monitoring, detection engineering, threat hunting, investigation documentation, and technical recommendations. Physical data center inspections, hardware servicing, network cabling, and on-site infrastructure operations must be performed by qualified local personnel. Production firewall or endpoint configuration changes, privileged access provisioning, live containment actions, account suspension, evidence acquisition requiring physical access, security infrastructure modifications, regulatory incident notifications, and formal compliance attestations must be performed or approved by appropriately authorized cybersecurity, IT, legal, or compliance professionals under established incident response and change management procedures.