Expert Agentic SOC – Cybersecurity Automation & Threat Detection - Onsite Abu Dhabi

Project overview

For a large financial institution in Abu Dhabi in an international environment, an experienced specialist is sought to expand modern SOC and security automation capabilities. The focus is on the operational processing of complex security incidents as well as the development of powerful, agent-based analysis and response mechanisms within a large, international security team. A hands-on expert with strong technical depth in SOC processes, detection engineering, and AI-supported security automation is sought.

Responsibilities

Absolutely Required

Advantageous

• Conception and implementation of agent-based use cases for the automated analysis of phishing, BEC, and email-based security incidents, including actionable recommendations for the SOC.
• Automation of alert triage in SIEM/XDR environments to reduce false positives, including context enrichment, preliminary assessment, and clean ticket documentation.
• Execution of cross-platform threat hunting approaches across SIEM, EDR, and cloud logs, as well as derivation of robust attack hypotheses and timelines.
• Integration and orchestration of LLM and agent frameworks into existing SOC processes, considering security guardrails and controlled automation.
• Development and validation of search queries and detection logic in KQL and SPL to support automated investigations and hunting scenarios.
• Connection of relevant interfaces such as Identity Providers, ticketing systems, and email platforms via APIs for end-to-end automation of analysis and response workflows.
• Development of mechanisms for monitoring credential leaks, fraudulent domains, and external threat indicators using OSINT and threat intelligence sources.
• Definition and implementation of controlled response measures such as endpoint isolation, temporary privilege revocation, or MFA enforcement in the sense of a zero-trust approach.
• Close collaboration with an international security team in operational incident handling, prioritization of critical findings, and continuous improvement of SOC workflows.
• Several years of practical experience in SOC, incident response, or detection engineering environments.
• Profound expertise with LLM/agent frameworks such as LangChain, LlamaIndex, AutoGen, CrewAI, or Semantic Kernel.
• Very good understanding of common SIEM, EDR, or XDR platforms, e.g., Microsoft Sentinel, Splunk, CrowdStrike, or Microsoft Defender.
• Confident application of KQL and/or SPL for creating, automating, and validating security queries.
• Experience in integrating APIs and security-related platforms such as Entra ID, Okta, ServiceNow, Jira, or Microsoft Graph.
• Deep know-how in threat intelligence, MITRE ATT&CK, OSINT, as well as log analysis in Windows, Linux, and cloud environments.
• Experience with zero-trust architectures and automated containment measures.
• Practical experience in detecting phishing infrastructures, lookalike domains, and credential leaks.
• Experience in international enterprise environments with large security organizations.

Project details

• Start: 12/2026
• Duration: 4 Monate+
• Remote: onsite
• Location: Abu Dhabi, DE
• Languages: German