Information Security Engineer (SOC L )

About Tabby

Tabby is a FinTech company focused on reshaping financial interactions by providing payment solutions that offer flexibility and control. With over 25 million users, Tabby enables shoppers to split payments online and in-store without interest or fees. The company partners with over 70,000 global brands and small businesses, including Amazon, Noon, IKEA, and SHEIN, generating over $18 billion in annual transaction volume. Launched in 2019, Tabby has secured over $1 billion in funding and is valued at $ billion, making it a leading and rapidly growing FinTech in the GCC region.

The Role of Information Security Engineer (SOC L)

As an Information Security Engineer, you will be instrumental in monitoring and defending Tabby's infrastructure, applications, and cloud environments against cyber threats. This full-time position, based in Riyadh, Saudi Arabia, requires 2-5 years of experience. The role involves leading incident response efforts, developing and refining detection rules, investigating security events, and collaborating with various teams to enhance the overall security posture.

Key Responsibilities

• Monitor and analyze logs and alerts from diverse sources, including firewalls, intrusion detection/prevention systems (IDS/IPS), endpoints, servers, and cloud platforms.
• Correlate events from multiple sources to identify advanced threats and unusual behavioral patterns.
• Fine-tune alert thresholds and detection logic to minimize false positives and improve the signal-to-noise ratio.
• Maintain dashboards and reporting to provide real-time visibility into the security posture.
• Serve as a frontline responder for security incidents, managing them through their entire lifecycle: detection, containment, eradication, recovery, and lessons learned.
• Coordinate with internal stakeholders and external vendors during high-severity incidents or data breaches.
• Perform root cause analysis and forensic investigations using endpoint and network-based artifacts.
• Maintain detailed incident documentation and contribute to post-mortem analysis and reports.
• Research emerging threats and trends.
• Contribute to the creation and tuning of detection rules, threat-hunting queries, and use cases across multiple platforms, including cloud environments.
• Maintain the Cyber Threat Intelligence (CTI) Platform and integrate CTI feeds with security controls for active CTI-driven detections.
• Communicate effectively with cross-functional teams, including IT, DevOps, Risk, and Compliance, during incidents and investigations.
• Provide concise and clear updates during incident handling to stakeholders and management.
• Mentor junior analysts and assist in training efforts within the Security Operations Center (SOC) team.

Experience Required

Candidates should possess 2-5 years of experience in information security, specifically within a Security Operations Center (SOC) environment or a similar role focused on threat detection, incident response, and security monitoring.

Work Environment

This is a full-time position located in Riyadh, Riyadh, Saudi Arabia. The role involves working collaboratively with various internal teams to maintain and enhance the company's security posture.