Security Engineer NDR

About Us Core42, a leader in AI-powered cloud and digital infrastructure, is driving transformative technology solutions globally. Leveraging advanced resources and partnerships, Core42 empowers clients to harness sovereign AI infrastructure, especially in sectors with stringent regulatory needs. With a mission to redefine digital transformation, we combine sovereign capabilities with scalable, high-performance compute infrastructure, positioning itself at the forefront of AI innovation in the Middle East and beyond.The opportunity Security Engineer - NDR & Cloudflare, Core42 - Abu Dhabi, UAE. We are seeking an experienced Security Engineer responsible for the design, implementation, administration and continuous improvement of the organisation's Corelight Network Detection & Response (NDR) and Cloudflare platforms. The role will focus on enhancing network visibility, threat detection, Zero Trust security, DDoS protection, WAF, web application security, DNS security and incident response capabilities across enterprise and cloud environments. The candidate will work closely with Platform Engineering, SOC, Incident Response, Network Engineering, Infrastructure, Cloud and Security Architecture teams to strengthen the organisation's cyber defence posture.Your key responsibilities Corelight NDR administration & engineeringDesign, deploy, manage and maintain Corelight sensors across enterprise, cloud and data centre environmentsDevelop and optimise network detection use cases leveraging Zeek, Suricata, Corelight Smart PCAP, threat intelligence integrations and YARAEnsure complete east-west and north-south traffic visibilityEstablish network baselines and anomaly detection capabilitiesIntegrate Corelight with SIEM and SOC platformsMonitor health, performance and capacity of NDR infrastructureDetection engineering & threat huntingDevelop and tune custom Corelight detectionsCreate behavioural and anomaly-based detection use casesConduct proactive threat hunting using network telemetry, DNS, HTTP and TLS logs, SMB activity and authentication trafficImplement MITRE ATT&CK aligned detection coverageReduce false positives while improving detection fidelityCloudflare security administrationDesign and manage web application security services including WAF, bot management, rate limiting, API security and custom security rulesManage DNS security including Cloudflare DNS, DNSSEC and secure DNS policiesDeliver Zero Trust security using Cloudflare Access, Secure Web Gateway, browser isolation, identity integrations and device trust controlsManage network protection services including DDoS protection, Magic Transit, Magic Firewall and Magic WANIncident response & investigationsInvestigate network-based attacks and anomaliesSupport malware investigations and forensic activitiesPerform packet analysis and network forensicsLead triage and containment activities during security incidentsDevelop and maintain incident response playbooksSecurity monitoringEnhance detection coverage across cloud, network, data centre and internet edgeDevelop KPIs and security metricsIdentify security gaps and recommend improvementsIntegration & automationIntegrate Corelight and Cloudflare with IDP, SIEM, Cribl, EDR, ITSM, threat intelligence platforms, SOAR platforms, LDAP, AI, ML and CMDBDevelop automation scripts using Python, PowerShell and REST APIsGovernance, compliance & security standardsEnsure solutions align with NIST 800-53, NIST CSF, ISO 27001, CIS Controls, SOC 2, UAE Information Assurance Standards, internal policies and procedures, and regulatory requirementsSupport audits and compliance assessmentsWhat we’re looking for (a) Required skills / qualificationsBachelor's degree in Cyber Security, Computer Science, Information Security or IT Engineering5-7 years of cybersecurity experience managing network security technologiesHands-on experience with Corelight NDR or Zeek-based solutionsHands-on experience with Cloudflare security servicesExperience supporting enterprise-scale networks and cloud environmentsExperience in SOC, incident response, threat hunting or security engineering functionsStrong network security fundamentals: TCP/IP, DNS, HTTP/HTTPS, TLS and packet analysisCorelight NDR, Zeek and SuricataCloudflare WAF, Cloudflare Access, Zero Trust, DDoS protection, DNS security, Magic Transit, Magic Firewall and Cloudflare Analytics(b) Preferred skills / qualificationsPython and PowerShell scriptingCertifications: Cloudflare Certified Administrator, Security+ or equivalent certifications in network securityWhat working at Core42 offers With a diverse team of 1,100+ employees from 68 nationalities, we foster an inclusive, innovative and collaborative environment. At Core42, we foster a culture grounded in trust, accountability and high performance. We are united by our values: Grit, where we overcome challenges with resilience and determination, Passion, which drives us to pursue excellence in everything we do, and Impact, as we aim to inspire progress and create meaningful change. Our team members thrive in an environment where each person’s contributions propel us forward, and together, we commit to achieving extraordinary results. Competitive Salary: We offer an attractive salary package based on your skills and experience Yearly Bonus: In recognition of your contributions, you will receive a performance-based annual bonusExclusive Discount Cards: Access special benefits with Esaad and Fazaa cards, offering discounts across a wide range of servicesPremium Family Insurance: We provide comprehensive health coverage, including dental, vision and life insurance, ensuring the well-being of you and your familyLearning & Development: We offer access to top-tier learning platforms to help you grow in your career. Learn at your own pace with unlimited access to premium courses.