Senior Cybersecurity Specialist in banking domain

We have an urgent requirement for Senior Cybersecurity Specialist in banking domain (Must) is required for our banking clients in Abu Dhabi ,UAE

 Lead SOC operations, threat hunting, SIEM/XDR monitoring, incident response, digital forensics, SOAR automation, and regulatory incident reporting.--Must

Strong experience with Splunk, Sentinel, QRadar, MITRE ATT&CK, EDR/XDR, and threat intelligence.--Must

Design and secure enterprise banking infrastructure including core banking, payments (SWIFT, cards, ATM), cloud (Azure/AWS), IAM/PAM, Zero Trust, DLP, WAF, and network security.--Must

Ensure compliance with CBUAE regulations, UAE IA (NESA), UAE PDPL, PCI-DSS, SWIFT CSP, ISO 27001, and NIST CSF.--Must

Conduct risk assessments, audits, vendor security reviews, and remediation tracking.--Must

Embed security into CI/CD pipelines using SAST, DAST, and SCA tools.--Must

Perform secure code reviews and secure APIs, microservices, containers, and Kubernetes environments aligned with OWASP standards.--Must
Banking Domain --Must

Role Purpose

The Senior Cybersecurity Specialist protects the bank's entire technology estate across all business lines, together with its customer data, against an evolving threat landscape. The scope is bank-wide: retail and digital banking, corporate and wholesale banking, treasury, payments and cards, branches and ATMs, the contact centre, core banking, data platforms, enterprise and corporate IT (end-user computing, email and collaboration), infrastructure and network, data centres and cloud, and third-party and vendor-connected systems. The role leads technical security work across the full lifecycle, from secure design and engineering through detection, response and recovery, and can be rotated into the Security Operations Centre (SOC) when needed. It ensures the bank's controls remain compliant with UAE regulatory requirements, including those of the Central Bank of the UAE (CBUAE) and national cybersecurity authorities. Working with business units, IT and technology teams and agile squads across the bank, the role makes security an enabler of safe, fast delivery rather than a late-stage gate.Key ResponsibilitiesSecurity Operations & Incident Response

• Act as an escalation point for SOC analysts, triaging and investigating high-severity SIEM alerts and coordinating containment.


• Lead proactive threat hunting across endpoint, network, identity and cloud telemetry, mapped to MITRE ATT&CK techniques.


• Manage cybersecurity incidents end to end, including evidence preservation, digital forensics and root-cause analysis.


• Develop, test and maintain incident response playbooks and SOAR automation for priority scenarios such as ransomware, account takeover and payment fraud.


• Run post-incident reviews and track lessons-learned actions through to closure.


• Prepare and submit regulatory incident notifications to the CBUAE, and other authorities as required, within mandated timelines.

Security Operations Centre (SOC) Rotation & Monitoring

• Perform L2/L3 SOC analyst duties during rotation, including 24x7 shift cover, with real-time monitoring and alert triage across SIEM and XDR.


• Monitor critical banking systems, including core banking, payments and SWIFT, ATM networks and digital channels, alongside enterprise IT and infrastructure.


• Tune use cases and detection rules, and develop correlation rules mapped to MITRE ATT&CK.


• Manage log source onboarding and coverage, prioritising critical assets and closing visibility gaps.


• Author and maintain SOAR playbooks and analyst runbooks.


• Run shift handover and case management, and escalate incidents in line with the severity matrix.


• Manage the MSSP / outsourced SOC relationship and its SLAs where applicable.


• Report SOC metrics, including alert volumes, triage times, false-positive rates and detection coverage.

Threat & Vulnerability Management

• Oversee vulnerability assessment scanning across the bank's infrastructure, endpoints, applications, data centres and cloud estates, and prioritise remediation by risk.


• Coordinate internal and third-party penetration tests, and support red team and purple team exercises.


• Govern the patch management process, tracking critical and high vulnerabilities against remediation SLAs and managing risk exceptions.


• Consume and operationalise threat intelligence, including UAE Cyber Security Council / aeCERT advisories and FS-ISAC feeds, turning it into detections and preventive controls.

Security Architecture & Engineering

• Conduct secure design reviews across the bank's estate: core banking, payment systems (UAEFTS/IPP/Aani, card switch, SWIFT), ATM and branch networks, data platforms, digital and mobile channels, open finance APIs, and hybrid cloud workloads on Azure and AWS (UAE regions).


• Drive zero trust and network segmentation across data centres, branches, ATM networks, cloud and third-party connections, including OT and building systems where relevant.


• Define and assure identity controls, including Active Directory hardening, identity and access management (IAM) and privileged access management (PAM), across enterprise IT and business applications.


• Engineer and tune EDR/XDR on endpoints and servers, web application firewall (WAF), data loss prevention (DLP), and email and collaboration security controls.


• Advise on encryption standards, hardware security modules (HSM) and key management practices.

Application & DevSecOps Security

• Embed SAST, DAST and SCA tooling in CI/CD pipelines, with clear quality gates and triage workflows for development teams.


• Ensure applications and APIs are assessed against the OWASP Top 10 and OWASP API Security Top 10.


• Perform and guide secure code reviews for high-risk changes.


• Define security baselines for microservices, containers and Kubernetes platforms, including image scanning, secrets management and runtime protection.

Governance, Risk & Compliance

• Maintain alignment with CBUAE information security and technology risk regulations and standards.


• Apply the UAE Information Assurance Standards (UAE IA, formerly NESA) and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).


• Support compliance with the CBUAE Open Finance Regulation, PCI DSS and the SWIFT Customer Security Programme (CSP).


• Map controls to ISO/IEC 27001 and the NIST Cybersecurity Framework, and keep policies and standards current.


• Perform cybersecurity risk assessments and third-party/vendor security assessments.


• Support internal and external audits and regulatory inspections, including evidence preparation and remediation tracking.

Awareness & Collaboration

• Design and run phishing simulations and targeted security awareness training.


• Advise business units, IT/technology teams and agile squads across the bank on security requirements, risk trade-offs and secure delivery.


• Mentor and coach junior security analysts and engineers.


• Liaise with external partners, vendors, peer banks and regulators on cybersecurity matters.

Key Performance IndicatorsKey Performance IndicatorMeasureMean time to detect (MTTD) and mean time to respond (MTTR)Trend improvement against agreed baselinesCritical vulnerability remediationPercentage remediated within SLAAudit findingsPercentage closed by agreed due dateRegulatory findingsZero repeat findingsPhishing simulation click rateReduction against prior periodSecurity sign-off for deliveryCompleted within sprint timelinesAlert triage timeMedian time to triage within severity SLAFalse-positive rateReduction against prior quarter after tuningDetection coverage vs MITRE ATT&CKPercentage of priority techniques covered by tested detectionsLog source coverage of critical assetsPercentage of critical assets onboarded to the SIEMQualifications & Experience

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity or an equivalent discipline.


• 8+ years of experience in cybersecurity, of which at least 3 years in banking or financial services (GCC/UAE experience preferred).

CertificationsRequired: at least one of CISSP, CISM or OSCP.Preferred: GIAC (GCIH, GCIA, GCFA or GPEN); Splunk Core Certified or Splunk Enterprise Security; Microsoft SC-200; CompTIA CySA+; BTL1/BTL2; CEH; CCSP; Microsoft Azure or AWS security certifications; ISO/IEC 27001 Lead Implementer or Lead Auditor; CRISC.Technical Skills

• SIEM platforms such as Splunk, IBM QRadar or Microsoft Sentinel, with hands-on query skills in SPL, KQL and AQL, plus SOAR automation.


• EDR/XDR investigation and malware triage with tools such as CrowdStrike Falcon or Microsoft Defender.


• Privileged access management, for example CyberArk.


• Firewalls and next-generation firewalls (NGFW).


• Cloud security posture management (CSPM) tools for Azure and AWS.


• Scripting and automation in Python and PowerShell.


• Working knowledge of the MITRE ATT&CK framework, with Sigma and YARA rule writing for detection engineering and threat hunting.


• Log analysis across Windows event logs, Sysmon, Linux, and network, firewall, proxy and DNS logs.


• Network traffic analysis with Wireshark, Zeek and NDR tooling.


• Memory and disk forensics fundamentals, for example Volatility and KAPE.


• Threat intelligence platforms (MISP or equivalent TIP) and case management or ticketing tools such as ServiceNow SecOps or TheHive.

Behavioural Competencies

• Integrity and discretion in handling sensitive and confidential information.


• Calm, structured decision-making under pressure during live incidents.


• Clear, concise communication of technical risk to executives and non-technical stakeholders.


• Collaboration across technology, business, risk and audit teams.


• Commitment to continuous learning in a fast-changing threat landscape.