Detection Analyst

About the Role

NourNet is seeking an experienced Detection Analyst to join a client's cybersecurity team in Riyadh. This full-time, on-site role requires a strong background in SIEM/XDR detection engineering, advanced query development, and security monitoring optimization. Experience with Palo Alto Networks Cortex XSOAR is an advantage.

Primary Objective

The primary objective of this role is to support the Security Detection Lead in the design, development, implementation, and tuning of SIEM/XDR detection content. This work aims to enhance threat detection coverage, accuracy, and overall operational effectiveness within the client's security environment.

Key Responsibilities

• Develop, maintain, and optimize correlation rules, detection logic, dashboards, and reports across SIEM/XDR platforms.
• Analyze alert patterns, security events, and incident data to identify detection gaps and tuning opportunities.
• Translate threat intelligence findings and incident response insights into actionable detection rules and use cases.
• Perform regression testing for new and updated detection rules to validate functionality, accuracy, and performance.
• Maintain comprehensive documentation for detection rules, including logic, data sources, expected behavior, and tuning history.
• Collaborate with Tier-1 and Tier-2 SOC analysts to gather feedback and continuously improve detection effectiveness.
• Map detection use cases and rules to the MITRE ATT&CK framework and applicable regulatory controls.
• Support the integration and optimization of detection and incident response workflows using Cortex XSOAR, where applicable.
• Support continuous improvement of detection coverage while minimizing false positives and improving alert quality.

Qualifications and Experience

• 5-10 years of experience in SOC operations, detection engineering, or cybersecurity monitoring, with strong expertise in detection development and tuning.
• Advanced experience developing SIEM queries, correlation rules, and detection logic.
• Hands-on experience with SIEM/XDR platforms, alert analysis, and detection optimization.
• Experience with Palo Alto Networks Cortex XSOAR, including playbook automation, incident workflows, integrations, or security orchestration, is preferred.
• Proven experience in detection rule testing, validation, regression testing, and technical documentation.
• Strong understanding of threat intelligence, incident response, and security event analysis.
• Familiarity with MITRE ATT&CK and mapping detection capabilities to adversary tactics and techniques.
• Strong analytical, troubleshooting, and collaboration skills.

Preferred Certifications

• Relevant certifications in security operations, SIEM technologies, threat detection, or incident response.
• Vendor-specific SIEM/XDR certifications.
• Palo Alto Networks Cortex XSOAR-related training or certifications are an advantage.

Work Environment

This position is a full-time role based entirely on-site at the client's premises in Riyadh.