Senior Engineer Information Security (SOC)

About the Role

Tweeq is seeking a Senior Engineer, Information Security (SOC) to lead the technical aspects of its Security Operations Center (SOC) capabilities. This full-time position is based in Riyadh, Saudi Arabia, and requires 5-10 years of relevant experience. The role focuses on SIEM engineering, detection development, and threat intelligence within a regulated fintech environment.

Key Responsibilities

• Own and enhance the architecture, performance, and reliability of the Elastic SIEM environment.
• Design and maintain log ingestion pipelines, integrations, parsers, and data retention strategies.
• Develop, maintain, and improve detection use cases aligned with the MITRE ATT&CK framework, including custom detections for fintech-specific threats.
• Drive threat intelligence operations, analyzing threat actors, campaigns, and indicators of compromise (IOCs) relevant to Tweeq.
• Review high-severity incidents, validate escalations, and support effective incident resolution and post-incident reviews.
• Monitor the performance of the managed SOC provider, including service levels and detection quality.
• Act as a senior technical escalation point for complex SIEM, detection, and Cyber Threat Intelligence (CTI) challenges.
• Mentor junior SOC analysts and engineers, sharing knowledge and supporting skill development.

SIEM and Detection Engineering

This role involves expanding log source coverage, improving data quality, and troubleshooting complex platform issues. The Senior Engineer will establish standards for log onboarding and regularly assess SIEM health and resilience. Responsibilities also include conducting threat modeling and detection gap analysis to strengthen monitoring coverage and building custom detections for threats such as account takeover, payment fraud, and API abuse.

Cyber Threat Intelligence and SOC Governance

The position requires ensuring actionable intelligence is validated, enriched, and integrated into Elastic SIEM. It also involves overseeing brand protection activities, prioritizing findings, and coordinating takedown cases. For SOC governance, the role includes maintaining incident records and security evidence aligned with regulatory and audit requirements, including SAMA CSF and NCA ECC.

Qualifications and Experience

• Experience: 5-10 years in information security, with a strong understanding of incident investigation, incident management, and root cause analysis.
• Technical Skills: Experience integrating logs from various sources, including cloud environments like AWS and GCP. Scripting and automation skills, preferably with Python.
• Industry Knowledge: Understanding of fintech-related threats, including account takeover, payment fraud, API abuse, and mobile application threats.
• Frameworks: Familiarity with security and regulatory frameworks such as SAMA CSF, NCA ECC, PDPL, and PCI DSS.
• Certifications: Relevant Elastic and GIAC certifications are required. CTI certifications are expected, and CISSP, CISM, or equivalent senior security certifications are an advantage.
• Soft Skills: Strong analytical, communication, documentation, and problem-solving skills. Ability to work independently, take ownership of complex technical challenges, and support less experienced colleagues.

Work Environment

This is a hands-on senior individual contributor role that requires continuous improvement across security operations, tooling, and processes. The successful candidate will work closely with internal stakeholders and external partners to strengthen Tweeq's security posture in a dynamic fintech environment.