Cyber Defense Centre Analyst

About the business area

GBS is a group of highly skilled and talented professionals who form an essential part of ADCB's continued journey of success. With a proud history of commitment, innovation and delivery, GBS constantly strives for excellence whilst ensuring the highest standards of quality and risk awareness. Each and every member of the GBS family plays an integral role in driving ADCB's strategy, growth and digital evolution by working closely with our valued business partners to achieve exceptional customer experience through our outstanding service and support.

We are actively seeking an ambitious professional to join our Group Business Service team at ADCB to work alongside passionate colleagues who share your ambition to redefine excellence in UAE banking.

In this role, your key responsibilities include:

The SOC Analyst is responsible for continuous cyber security monitoring, analysis and investigation of real-time and historical security events to identify anomalies, policy violations, cyber risks and security incidents. The role conducts incident triage and forensic analysis, coordinates response and remediation activities, and manages cyber security incidents through to closure. The analyst supports the continuous protection of information systems and IT infrastructure through effective use of SIEM, SOAR, data leakage monitoring, email security analysis and other security technologies.

Security Monitoring, Detection & Analysis

• Perform day-to-day operational security monitoring and analyze real-time and historical events from SIEM and other security platforms.
• Identify security anomalies, suspicious activities, control or policy violations, indicators of compromise and potential cyber security risks.
• Validate and triage alerts, correlate events from multiple data sources and distinguish genuine incidents from false positives.
• Monitor data leakage indicators and support investigation of suspected data loss or unauthorized information transfer.
• Analyze phishing, malicious and suspicious emails, including URLs, attachments, headers and other indicators, and coordinate required containment actions.

Cyber Security Incident Response & Forensics

• Raise, classify, prioritize, investigate and manage cyber security incidents in accordance with established incident management procedures.
• Conduct forensic analysis and evidence review to determine incident scope, impact, root cause, attack path and affected assets where applicable.
• Coordinate containment, remediation, recovery and follow-up actions with infrastructure, application, network, endpoint and other relevant teams.
• Maintain complete incident records, investigation notes, evidence references, actions, decisions and closure documentation.
• Provide timely updates on day-to-day security activities and advise relevant stakeholders of incidents, risks, status and required actions.
• Provide and seek responses to queries related to security incidents, ensuring effective communication and timely resolution.

SIEM, SOAR & Security Operations Support

• Use Security Information and Event Management (SIEM) platforms for event monitoring, correlation, investigation and security incident detection.
• Use Security Orchestration, Automation and Response (SOAR) platforms to manage incident workflows, case handling, enrichment, escalation and response activities.
• Support security operations processes and security technologies to maintain continuous protection of information systems and IT infrastructure.
• Identify opportunities to improve detection logic, operational workflows, automation and response efficiency.

Stakeholder Coordination, Changes & Threat Advisory

• Liaise with internal teams and relevant stakeholders to exchange information related to security incidents and obtain required technical or business inputs.
• Initiate or request changes arising from security incidents and coordinate with responsible teams to implement preventive and mitigation controls.
• Provide and seek advisory on emerging cyber threats, attack techniques and observed security trends relevant to the environment.
• Work closely with infrastructure and SOC teams to deploy preventive, detective and mitigation controls based on investigation findings and identified risks.

Reporting, Metrics & Control Improvement

• Analyze operational data and prepare daily, weekly and monthly security reports documenting incidents, security threats, trends, response status and key observations.
• Maintain accurate security operations metrics and measurement records, including relevant Key Risk Indicators (KRIs).
• Use metrics and trend analysis to identify weaknesses in controls, recurring issues and areas requiring remediation or improvement.
• Track agreed remediation actions and support continuous improvement of SOC monitoring, incident handling and security controls.

The ideal candidate should have the following experience

• Working knowledge of security event monitoring, log analysis, correlation and investigation using SIEM solutions.
• Working knowledge of cyber security incident handling and case management through SOAR platforms.
• Understanding of security devices and technologies, including firewalls, IDS/IPS, endpoint security, email security, DLP, web security and network monitoring controls.
• Good understanding of network topologies, TCP/IP and common network protocols, security architecture and traffic analysis fundamentals.
• Understanding of malware, phishing, botnets, antivirus/endpoint protection, vulnerabilities, indicators of compromise and common cyber security terminology.
• Knowledge of incident response lifecycle, forensic investigation fundamentals, evidence handling and root-cause analysis.
• Ability to interpret security alerts and technical data, correlate information across multiple sources and clearly document investigation findings.
• Basic AI skills, including awareness of AI-assisted investigation, summarization and automation use cases in cyber security, with appropriate validation and human oversight.

Core Competencies

• Strong analytical and investigative mindset with attention to detail.
• Ability to prioritize and work effectively during active security incidents and time-sensitive investigations.
• Clear written and verbal communication for incident updates, escalations, reports and stakeholder coordination.
• Ability to collaborate across SOC, infrastructure, network, application and other technology teams.
• Discipline in maintaining accurate incident records, metrics, evidence and operational documentation.
• Continuous-learning mindset with interest in emerging cyber threats, AI and security automation.

Education, Certifications & Experience

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology or a related discipline.
• Relevant cyber security certifications are preferred, such as Microsoft Security, Security+, CySA+, GCIH, GCIA or equivalent certifications appropriate to the role.
• Practical experience in SOC operations, security monitoring, incident response, SIEM and/or SOAR environments is preferred; experience in banking or financial services is an advantage.
• Ability to support shift-based or on-call SOC operations where required by the operating model.

Primary Skill Profile

• Security Incident Monitoring & Response
• Security Event Analysis & Investigation
• Digital Forensics Fundamentals
• SIEM Monitoring & Correlation
• SOAR-Based Incident Management & Automation
• Phishing & Malicious Email Analysis
• Data Leakage Monitoring
• Security Reporting, Metrics & KRIs
• Network & Security Technology Fundamentals
• Basic AI Skills for Cyber Security Operations

What we offer:

• Competitive Salary. Additionally, all employees are eligible to participate in one of our rewarding variable pay plans.
• Comprehensive Benefits Package: This includes market-leading medical insurance, group life and personal accident insurance, paid leave and leave airfare, employee preferential rates on loans and finance facilities, staff discounts and offers, and children education assistance (for certain job levels).
• Flexible and Remote Working Options: We understand the importance of work-life balance and offer flexible working arrangements, subject to eligibility and job requirements.
• Learning and Development Opportunities: We value and facilitate continuous learning and personal development, through a variety of exciting learning opportunities, such as structured instructor-led courses, a comprehensive e-Learning catalog, on-the-job training and professional development programs.

At ADCB, we are dedicated to creating a respectful, caring and disciplined work environment that aligns with your career ambitions.