Security Controls & Incident Response Engineer

About the role

The Security Controls & Incident Response Engineer ensures that security controls are effective and leads the full incident response lifecycle. This role bridges governance and operational defence by validating detective and corrective controls, driving incident detection, investigation, containment, and recovery.

Key responsibilities

• Execute and monitor detective, preventive, and corrective security controls across the SOC.
• Validate control implementation, operation, and evidence generation; perform control testing and effectiveness reviews.
• Support RCSA activities, document controls, and assess gaps.
• Lead the incident response lifecycle: detection, alert validation, investigation, containment, eradication, recovery, and post‑incident review.
• Coordinate with IT and business teams for remediation and recovery actions.
• Validate control performance during incidents and map controls to MITRE ATT&CK techniques.
• Collaborate with the SIEM engineering team to improve detection use‑cases and reduce false positives.
• Develop and support automated response workflows using SOAR platforms.

Required profile

• Strong understanding of security control frameworks such as ISO 27001 and NIST.
• Proven experience leading incident response activities from detection to recovery.
• Ability to perform control testing, RCSA documentation, and gap analysis.
• Experience working with SOC teams and coordinating cross‑functional remediation.

Required skills

• Security Incident and Event Management (SIEM) platforms.
• Security Orchestration, Automation and Response (SOAR) tools.
• MITRE ATT&CK framework knowledge.
• ISO 27001 and NIST security standards.
• Incident response lifecycle management.
• Control testing and validation techniques.
• Endpoint isolation and containment methods.

What we offer

• Opportunity to work in a leading Qatari bank with a focus on innovation and professional growth.
• Collaborative environment that supports work‑life balance.