Senior Engineer Information Security (SOC)

About the Role

Tabby is seeking a Senior Engineer, Information Security (SOC) to lead the technical aspects of its Security Operations Center. This full-time individual contributor role focuses on SIEM engineering, detection development, and threat intelligence within a regulated fintech environment. The position requires 2-5 years of experience.

Key Responsibilities

• Own and enhance the architecture, performance, and reliability of the Elastic SIEM environment.
• Design and maintain log ingestion pipelines, integrations, parsers, and data retention strategies.
• Develop and improve detection use cases aligned with the MITRE ATT&CK framework, including custom detections for fintech-specific threats.
• Drive threat intelligence operations using platforms like Cyble, analyzing threat actors and integrating actionable intelligence into the SIEM.
• Oversee brand protection activities, including prioritizing findings and coordinating takedown cases.
• Review high-severity incidents, validate escalations, and support effective incident resolution.
• Lead post-incident reviews and ensure documentation of root causes, remediation, and corrective actions.
• Monitor the performance of the managed SOC provider, including service levels and detection quality.
• Act as a senior technical escalation point for complex SIEM, detection, and CTI challenges.
• Mentor junior SOC analysts and engineers, sharing knowledge and fostering skill development.

Required Qualifications and Experience

• 4–5 years of progressive experience in SOC operations, SIEM engineering, detection engineering, or cyber threat intelligence.
• Strong hands-on experience with Elastic Stack, including SIEM administration, architecture, ingestion pipelines, and performance optimization.
• Proven ability to develop complex detection rules, correlation logic, and behavioral detections.
• Experience with MITRE ATT&CK and detection coverage analysis.
• Practical experience with threat intelligence platforms such as Cyble or equivalent tools.
• Strong understanding of incident investigation, incident management, and root cause analysis.
• Experience integrating logs from various sources, including cloud environments like AWS and GCP.
• Scripting and automation skills, preferably with Python.
• Understanding of fintech-related threats, including account takeover, payment fraud, API abuse, and mobile application threats.
• Familiarity with security and regulatory frameworks such as SAMA CSF, NCA ECC, PDPL, and PCI DSS.

Certifications

• Relevant Elastic and GIAC certifications are required.
• CTI certifications are also expected.
• CISSP, CISM, or equivalent senior security certifications are advantageous.

Skills and Attributes

• Strong analytical, communication, documentation, and problem-solving skills.
• Ability to work independently, take ownership of complex technical challenges, and support the development of less experienced colleagues.

Benefits of the Role

• Opportunity to address security challenges within a fast-growing fintech environment.
• Ownership of security tooling and detection capabilities protecting financial products and customer data.
• Direct impact on the maturity of the SOC and threat intelligence function.
• Collaboration with experienced security professionals and cross-functional engineering teams.