CSOC Operational Engineer - Level 2

Job Purpose At Emirates، we believe in connecting the world، to and through، our global hub in Dubai، and in constantly innovating to ensure our customers 'Fly Better

Key Responsibilities

• L evel 2 will perform advanced cybersecurity monitoring، analysis، and investigations to identify and resolve complex security incidents، threats and control issues

Requirements & Qualifications

• Knowledge/Skills: Advanced knowledge of CSOC detection، monitoring، incident response and operational workflows

• Knowledge/Skills

Benefits & Conditions

• Salary & benefits Join us in Dubai and enjoy an attractive tax-free salary and travel benefits that are exclusive to our industry، including discounts on flights and hotels stays around the world

• Salary & benefits

• Join us in Dubai and enjoy an attractive tax-free salary and travel benefits that are exclusive to our industry، including discounts on flights and hotels stays around the world

Join our Cybersecurity team، where we strive to maintain a world-class cybersecurity organisation built on the key principles of People، Process، and Technology، underpinned by executive endorsement of a multi-year strategy for continuous improvement and development

The team protects our digital assets by monitoring threats، responding to incidents، managing vulnerabilities، and ensuring compliance with security policies and regulations

The CSOC Operational Engineer

Provide technical guidance to Level 1 engineers، validate AI- and automation-supported findings and response actions، and coordinate with escalation specialists to ensure effective، timely and well-controlled incident resolution

In this role، you will: Guide Level 1 engineers and the decision support system to ensure correct diagnosis and effective use of approved AI and automation

Ensure timely resolution and fulfilment of escalated incidents، service requests and control issues within applicable SLAs

Maintain clear، accurate and auditable documentation، operational logs and effective handovers for complex incidents، service requests and control decisions

Monitor threat، vulnerability، service-health and control-performance information using approved analytical and automated capabilities، assess business and operational impact and initiate proportionate action

Perform detailed analysis of cyber threats، incidents، control failures and identity-related risks، validate AI- or automation-assisted findings and recommend preventative or corrective actions

Review operational triage and control-handling activities performed by Level 1 engineers or approved automation، ensuring accurate closure or escalation

Create and maintain operational procedures، automation playbooks، knowledge-base content and approved automation workflows، incorporating lessons from incidents and service issues

Qualification To be considered for this role، you must meet the below

Degree or Honours (12+3 or equivalent) in Information Technology and 3+ years of Cybersecurity Operations experience

GIAC Certified Incident Handler (GCIH) or equivalent certification

Strong working knowledge of the enterprise security platforms used for detection and response، including their capabilities، data sources، workflows and limitations، to support effective monitoring، investigation and incident handling

Knowledge of infrastructure، cloud، endpoint، server، operating-system and network security controls relevant to monitoring and response

Knowledge of protocol، web-service and database security concepts and their relevance to security operations

Practical knowledge of defence-in-depth، zero-trust and operational-resilience principles، including security queries، basic scripting and approved automation or AI decision-support systems

Analyse security events and operational evidence to identify threats، determine impact and recommend appropriate action

Triage and prioritise alerts and incidents according to risk، urgency and operational impact

Make timely decisions within delegated authority and escalate incidents to the appropriate response or resolver team

Apply safe، responsible and governed use of approved AI and automation tools within the role، protecting sensitive data، applying human oversight، validating outputs and complying with applicable policies and controls

Communicate security findings and operational updates clearly through accurate written and verbal reporting for technical and non-technical stakeholders

Leadership Role: No

Find out what it’s like to live and work in our fast-paced، cosmopolitan home city in the Dubai Lifestyle section of our website .

Job Purpose

At Emirates، we believe in connecting the world، to and through، our global hub in Dubai، and in constantly innovating to ensure our customers 'Fly Better'.

The team protects our digital assets by monitoring threats، responding to incidents، managing vulnerabilities، and ensuring compliance with security policies and regulations.

Provide technical guidance to Level 1 engineers، validate AI- and automation-supported findings and response actions، and coordinate with escalation specialists to ensure effective، timely and well-controlled incident resolution.

In this role، you will

Guide Level 1 engineers and the decision support system to ensure correct diagnosis and effective use of approved AI and automation.

Ensure timely resolution and fulfilment of escalated incidents، service requests and control issues within applicable SLAs.

Maintain clear، accurate and auditable documentation، operational logs and effective handovers for complex incidents، service requests and control decisions.

Monitor threat، vulnerability، service-health and control-performance information using approved analytical and automated capabilities، assess business and operational impact and initiate proportionate action.

Perform detailed analysis of cyber threats، incidents، control failures and identity-related risks، validate AI- or automation-assisted findings and recommend preventative or corrective actions.

Review operational triage and control-handling activities performed by Level 1 engineers or approved automation، ensuring accurate closure or escalation.

Create and maintain operational procedures، automation playbooks، knowledge-base content and approved automation workflows، incorporating lessons from incidents and service issues.

Qualification

To be considered for this role، you must meet the below

Degree or Honours (12+3 or equivalent) in Information Technology and 3+ years of Cybersecurity Operations experience.

GIAC Certified Incident Handler (GCIH) or equivalent certification.

Advanced knowledge of CSOC detection، monitoring، incident response and operational workflows.

Strong working knowledge of the enterprise security platforms used for detection and response، including their capabilities، data sources، workflows and limitations، to support effective monitoring، investigation and incident handling.

Knowledge of infrastructure، cloud، endpoint، server، operating-system and network security controls relevant to monitoring and response.

Knowledge of protocol، web-service and database security concepts and their relevance to security operations.

Practical knowledge of defence-in-depth، zero-trust and operational-resilience principles، including security queries، basic scripting and approved automation or AI decision-support systems.

Analyse security events and operational evidence to identify threats، determine impact and recommend appropriate action.

Triage and prioritise alerts and incidents according to risk، urgency and operational impact.

Make timely decisions within delegated authority and escalate incidents to the appropriate response or resolver team.

Apply safe، responsible and governed use of approved AI and automation tools within the role، protecting sensitive data، applying human oversight، validating outputs and complying with applicable policies and controls.

Communicate security findings and operational updates clearly through accurate written and verbal reporting for technical and non-technical stakeholders.

Leadership Role: No.