Cybersecurity Operations Center Expert

Role overview

This position focuses on advising a government cybersecurity operations environment on continuous monitoring, incident handling, and digital forensic activities. The role is intended for a specialist who can help strengthen threat detection, response coordination, and the overall maturity of monitoring processes.

Key responsibilities

• Guide 24/7 cybersecurity event monitoring efforts to help identify malicious activity and cyberattacks.
• Advise on cyber incident response work and digital forensic analysis tasks.
• Support the sorting, assessment, and prioritization of detected incidents.
• Recommend forensic follow-up actions for security events and the necessary escalation steps.
• Provide technical input to the monitoring and response team when reviewing alerts and incidents, including their paths and priority levels.
• Advise on containment measures, response procedures, and escalation of cyber incidents according to approved severity levels.
• Suggest improvements to detection rules and use cases based on monitoring and investigation outcomes.
• Recommend adjustments to event log sources and coverage to improve monitoring accuracy and preserve investigation evidence.
• Propose priorities for proactive threat hunting based on cyber threat intelligence and risk patterns.
• Recommend runbooks and operating procedures for recurring incident types to speed up response time.
• Suggest how cybersecurity policies, standards, controls, and recommendations should be implemented.
• Follow the policies, work practices, and procedures of the organizational unit.
• Carry out any other duties assigned by direct supervisors.

Education and qualifications

A bachelor's degree in cybersecurity or another discipline related to the field is required. A master's degree in cybersecurity or a closely related specialization is preferred.

Professional certifications preferred

• Certified Information Systems Security Professional (CISSP)
• GCIH — GIAC Certified Incident Handler
• GCIA — GIAC Certified Intrusion Analyst
• GMON — GIAC Continuous Monitoring
• GCFA — GIAC Certified Forensic Analyst
• CompTIA CySA+
• CompTIA Security+

Experience

Six years of experience related to the same field is required.

Additional notes

This role is based in Riyadh, Saudi Arabia, and is a full-time, on-site position.