شرح موقعیت
🏗 We're Hiring: Senior SIEM Content Specialist 📍 Location: United Arab Emirates (Remote) 🕒 Employment Type: Full-Time 💼 Experience Level: Mid-Level to Senior 🌐 Work Arrangement: Fully Remote About Us We are a construction-focused organization committed to delivering complex projects through disciplined contract management, operational excellence, risk management, and collaborative project delivery. Our distributed teams work across Project Management, Construction, Engineering, Procurement, Commercial, Legal, Finance, Human Resources, Design, Quality, HSE, Consultants, Contractors, Suppliers, Logistics, Administration, Information Technology, and Executive Leadership. As our organization expands its digital operations, protecting business systems, project information, corporate data, and interconnected technology environments remains a critical priority. We are committed to strengthening cybersecurity through proactive threat detection, reliable security monitoring, standardized controls, and continuous improvement. Our teams value technical expertise, accountability, collaboration, and practical security solutions that support operational resilience. The Role We are seeking an experienced Senior SIEM Content Specialist to develop, maintain, optimize, and govern security monitoring content across enterprise Security Information and Event Management (SIEM) platforms. The successful candidate will specialize in creating high-quality detection rules, correlation searches, analytics, dashboards, alert logic, investigation queries, and supporting content that enables security teams to identify and respond to potential threats effectively. The role will translate threat intelligence, incident findings, adversary techniques, security requirements, and business risks into tested, maintainable, and actionable detection content. Working closely with Security Operations, Detection Engineering, Threat Intelligence, Incident Response, Infrastructure, Cloud, Network, and Identity teams, the specialist will improve detection coverage, reduce unnecessary alerts, enhance investigation efficiency, and maintain consistent content quality across the organization's security monitoring environment. The ideal candidate will have strong hands-on experience with SIEM platforms, query development, detection engineering, event normalization, content testing, version control, and security use-case lifecycle management. The position requires a disciplined approach to technical documentation, controlled deployment, measurable detection performance, and alignment with applicable UAE requirements and recognized cybersecurity practices. Key Responsibilities1. SIEM Detection Content Development Design, develop, implement, and maintain SIEM detection content for enterprise security monitoring environments. Create detection rules, correlation searches, scheduled analytics, real-time detections, alert conditions, and investigative queries. Translate security requirements, threat scenarios, incident reports, and threat intelligence into practical detection use cases. Develop content for identifying suspicious authentication activity, privilege escalation, lateral movement, persistence, malware execution, unauthorized access, and data exfiltration indicators. Create detections for suspicious administrative changes, abnormal account activity, unauthorized configuration changes, and potential misuse of privileged identities. Develop use cases covering endpoint security, network activity, email threats, cloud environments, identity platforms, servers, databases, and enterprise applications. Design detection logic that combines multiple event sources, behavioral indicators, thresholds, time windows, entity relationships, and contextual conditions. Build content that supports both automated alert generation and analyst-driven investigation. Ensure detection rules include clear objectives, required data sources, relevant event fields, expected outcomes, and escalation criteria. Apply consistent naming conventions, severity classifications, metadata, tagging, and documentation standards. Maintain content that is understandable, reusable, testable, and suitable for ongoing operational support. Identify opportunities to improve detection precision through contextual enrichment, risk scoring, and multi-stage analysis. Avoid unnecessary complexity and ensure content remains aligned with the intended threat scenario. Maintain a structured backlog of new detection requirements, enhancement requests, and technical debt. 2. SIEM Platform Content Management Develop and maintain security content within enterprise SIEM platforms such as Microsoft Sentinel, Splunk Enterprise Security, IBM QRadar, Google Security Operations, or equivalent solutions. Use platform-specific query languages and analytics capabilities to implement reliable and efficient detections. Develop and optimize searches using technologies such as Kusto Query Language (KQL), Splunk Search Processing Language (SPL), AQL, YARA-L, or comparable query languages, depending on the platform. Maintain platform-supported analytics rules, correlation rules, event searches, dashboards, reports, lookup tables, watchlists, reference data, and related content. Configure content dependencies, parameters, schedules, thresholds, and execution settings. Ensure content is compatible with the relevant platform version, data model, schema, and integration architecture. Troubleshoot query errors, field mapping issues, parsing inconsistencies, performance bottlenecks, and content execution failures. Optimize searches to reduce unnecessary resource consumption and improve processing efficiency. Maintain compatibility with changes to platform capabilities, data schemas, integrations, and security products. Support content migration between development, testing, and production environments. Maintain a documented inventory of deployed content, platform dependencies, owners, versions, and operational status. Evaluate new platform capabilities and determine whether they provide measurable improvements to detection quality or analyst productivity. 3. Detection Use-Case Engineering Develop and maintain a structured library of security detection use cases aligned with organizational risks and threat scenarios. Convert threat modeling outputs, incident lessons learned, vulnerability assessments, and adversary techniques into actionable monitoring requirements. Map detection content to the MITRE ATT&CK framework where appropriate. Identify gaps between documented threats, available telemetry, implemented detections, and validated monitoring capabilities. Prioritize use cases according to asset criticality, threat relevance, potential business impact, and available data. Define detection objectives, prerequisites, expected event patterns, success criteria, and known limitations. Develop content for common attack behaviors, including credential attacks, suspicious remote access, unauthorized privilege changes, malicious scripts, command execution, and persistence. Create monitoring content for cloud control-plane activity, identity misuse, suspicious API access, and unauthorized changes to security configurations. Develop detections relevant to sensitive business information, engineering documents, financial records, procurement systems, project applications, and corporate collaboration platforms. Maintain traceability between each use case, its underlying risk, supporting data sources, and implemented detection content. Review existing use cases to identify outdated logic, redundant coverage, missing scenarios, or insufficient context. Collaborate with Security Operations and Threat Intelligence teams to validate the operational relevance of proposed use cases. Establish measurable acceptance criteria for new and materially changed detections. Maintain a prioritized roadmap for detection content development and improvement. 4. Detection Testing and Validation Design and execute testing procedures to validate detection content before production deployment. Test rules against representative historical events, controlled test data, approved simulations, and known incident examples. Verify that detections identify expected behavior and distinguish relevant threats from common benign activity. Develop positive and negative test cases to assess detection accuracy and identify potential blind spots. Validate event field mappings, time-window conditions, thresholds, entity extraction, alert enrichment, and severity assignments. Confirm that required log sources and fields are available and populated as expected. Test content behavior under missing data, delayed ingestion, duplicated events, incomplete records, and other realistic operating conditions. Document test objectives, test data, results, limitations, and remediation requirements. Coordinate with authorized penetration testing, purple team, threat hunting, and security validation teams where appropriate. Use controlled adversary simulations and detection validation exercises to measure the effectiveness of implemented content. Investigate failed test cases and improve detection logic or telemetry requirements. Perform regression testing after significant rule changes, platform upgrades, schema changes, or integration updates. Ensure high-impact detections are adequately validated before being enabled in production. Maintain evidence of testing and approval in accordance with organizational change management procedures.