Full-Time
Level 3 Security Operations Center Analyst
Saviynt
1,001-5,000 employees
Cloud identity security and access governance
No salary listed
Remote in UK
Remote
Applicants must have at least five years of prior UK residency and provide right-to-work documentation.
UK Citizenship, UK Top Secret Clearance Required
Bachelor's
 Cybersecurity (1) |
|---|
Get referred to Saviynt
See people who can refer or advise you
- A Bachelor's degree in Computer Science, Cybersecurity, or a related discipline, or equivalent industry experience.
- Extensive experience in Security Operations with demonstrable experience as a senior analyst, threat hunter, or Level 3 analyst.
- Strong hands-on experience in cloud security monitoring and incident response across Amazon Web Services; Amazon Web Services experience is essential.
- Proven scripting and automation capability using Python, Go, PowerShell, and Bash.
- Practical experience with Security Orchestration, Automation and Response platforms and Security Information and Event Management technologies.
- Deep understanding of Endpoint Detection and Response tooling, host and network forensics, and detection engineering practices.
- Strong working knowledge of the MITRE ATT&CK framework and its application in threat detection and hunting.
- At least five years of UK residency immediately prior to application.
- Ability to obtain and maintain Security Check clearance and pass National Security Vetting.
- Right to work in the UK and British citizenship, with original verification documentation required.
- Adherence to Saviynt information security and privacy policies and procedures, including annual security training.
- Act as the final escalation point for complex incidents originating from Level 1 and Level 2 analysis.
- Lead investigations into high-severity security events impacting Amazon Web Services, Kubernetes clusters, and hybrid environments.
- Perform advanced forensic analysis across endpoints, cloud workloads, and network telemetry to determine root cause, impact, and remediation actions.
- Correlate telemetry from Security Information and Event Management, Endpoint Detection and Response, Cloud Security Posture Management, and cloud-native sources to identify sophisticated attack chains.
- Design, develop, and maintain automated response playbooks within the Security Orchestration, Automation and Response platform.
- Build and maintain automation scripts for alert enrichment, evidence collection, and containment.
- Integrate security platforms through application programming interfaces to enable automated detection and response workflows.
- Identify opportunities to reduce Mean Time to Detect and Mean Time to Respond through automation and process optimisation.
- Conduct proactive threat hunting across enterprise and cloud environments using intelligence-driven and hypothesis-based methodologies.
- Serve as a subject matter expert for cloud security monitoring using AWS GuardDuty, CloudTrail, CrowdStrike, and Proofpoint.
- Develop and tune Security Information and Event Management detections, correlation rules, and Endpoint Detection and Response queries aligned to MITRE ATT&CK tactics and emerging threat intelligence.
- Provide technical mentoring and guidance to Level 1 and Level 2 analysts.
- Maintain and enhance Security Operations Center documentation, including standard operating procedures, runbooks, and response playbooks.
- Analyse incident trends and operational metrics to recommend improvements in detection coverage, automation effectiveness, and security posture.
Saviynt provides a cloud-based identity security and access governance platform that helps organizations manage digital identities for employees, vendors, and machines. It offers identity governance and administration, third-party access governance, and cloud privileged access management, using automated workflows and identity analytics to reduce risks and maintain audit readiness. The product helps enterprises implement governance from the start, minimize separation-of-duty risks across apps, and stay compliant while lowering costs through a subscription model and scalable deployment across diverse industries.
Company Size
1,001-5,000
Company Stage
Series B
Total Funding
$1.1B
Headquarters
El Segundo, California
Founded
2010
Get referred to Saviynt
See people who can refer or advise you
Simplify's Take
What believers are saying
- Saviynt crossed $300 million ARR on July 28, 2026, with 96% retention.
- Bookings rose over 80% in 2026, signaling expansion across existing accounts.
- September 8, 2026 MEA hiring and Saudi hosting plans open a new regional channel.
What critics are saying
- SailPoint, Okta, and CyberArk compress Saviynt's differentiation during 2026 renewals.
- Long, services-heavy deployments keep customers dependent on partners like Simeio.
- If Zuma stalls, Saviynt remains a premium IGA vendor, not an AI security platform.
What makes Saviynt unique
- Saviynt's July 2026 Zuma unifies human, AI, and non-human identity governance.
- Carrick's August 31, 2026 continuation vehicle validates Saviynt as a category winner.
- Saviynt spans IGA, PAM, and application access governance in one platform.
Help us improve and share your feedback! Did you find this helpful?
Benefits
Remote Work Options
Flexible Work Hours
Growth & Insights and Company News
6 month growth
↑ 0%1 year growth
↑ 0%2 year growth
↑ 1%Saviynt appoints Kamel Heus as Vice President of Sales for the Middle East and Africa. Cybersecurity veteran to drive regional growth, strengthen partner ecosystem and advance identity security across MEA Dubai, United Arab Emirates, September 8, 2026: Saviynt, a leading provider of identity security solutions, today announced the appointment of Kamel Heus as Vice President of Sales for the Middle East and Africa (MEA). Based in Dubai, Heus will lead Saviynt's business across the MEA region, including Turkey, as the company advances its growth and strengthens its presence in key markets. In his new role, Heus will drive new business, renewals and customer expansion across MEA, while leading Saviynt's regional channel strategy, expanding its partner ecosystem, and building out the company's local go-to-market team. As AI reshapes how organizations across government, banking and financial services, utilities, healthcare, oil and gas, and retail approach identity, Heus' appointment reflects the growing importance of securing both agentic identities and AI-driven environments. His near-term priorities include deepening Saviynt's regional presence, expanding into Saudi Arabia, and growing local hosting capabilities to meet in-region delivery and data residency requirements. "MEA represents a significant opportunity for Saviynt as organizations across the region accelerate their digital transformation and increasingly look to AI to transform how they operate and grow," said Pete Angstadt, Chief Commercial Officer at Saviynt. "Our role is to help customers move faster on that journey while ensuring security and governance keep pace. Kamel's deep experience in the region and understanding of its customers, markets and partner ecosystem will be invaluable as we continue to expand our presence. We're making a long-term investment in MEA, and his appointment is an important step in bringing Saviynt closer to our customers and partners as we help accelerate their AI journey securely." Heus will also help MEA businesses address a new category of identity risk: AI agents. As these agents gain access to enterprise applications and data, they require the same discovery, governance and lifecycle controls that are traditionally applied to human identities. Saviynt's Zuma platform is built to meet this need, giving organizations visibility into AI identities and the ability to enforce least-privilege access across their lifecycle. "The Middle East and Africa have become one of the fastest-growing cybersecurity markets in the world, and Identity sits right at the center of it, especially as AI agents enter the enterprise," said Kamel Heus, Vice President of Sales, MEA, Saviynt. "I've spent over a decade building businesses from the ground up in this region, and I'm excited to do it again at Saviynt. My focus is to build out our local presence, grow a strong partner ecosystem, and enable organizations across MEA to grow their business through secure, confident access both for their people and their AI. It's a great time to be doing this work here." BusinessConsulting Services Heus brings 20 years of enterprise cybersecurity sales leadership and a strong track record of building and scaling businesses across the Middle East, Africa and Europe. He has held senior leadership roles at Thales, Centrify (now Delinea) and Sophos, most recently serving as Vice President, EMEA at Thales, where he led the company's Identity and Access Management business across the region. He holds a PhD in Applied Mathematics and Computing from Université Grenoble Alpes in France and has been based in Dubai for more than a decade. With Heus leading its MEA sales organization, Saviynt will continue to deepen its relationships with customers and partners, expand its regional capabilities and help organizations strengthen identity security as cloud, AI and digital transformation reshape enterprise environments.
Saviynt expands MEA push with Kamel Heus as regional sales Chief. 2 minutes read Saviynt is stepping up its expansion across the Middle East and Africa with the appointment of cybersecurity veteran Kamel Heus as Vice President of Sales for MEA, including Turkey. Based in Dubai, Heus will be responsible for growing Saviynt's regional business, from new customer acquisition and renewals to expanding existing accounts. He will also oversee the company's channel strategy, partner ecosystem and local go-to-market organisation. The appointment comes as organisations across the region accelerate cloud adoption and AI deployments, creating a more complex identity security challenge. Saviynt is increasingly positioning identity as a control point not only for employees and applications, but also for the growing number of AI agents accessing enterprise systems and data. Heus will have a particular focus on expanding Saviynt's presence in Saudi Arabia and developing local hosting capabilities to address requirements around in-region delivery and data residency. "MEA represents a significant opportunity for Saviynt as organisations across the region accelerate their digital transformation and increasingly look to AI to transform how they operate and grow," said Pete Angstadt, Chief Commercial Officer at Saviynt. "We're making a long-term investment in MEA, and his appointment is an important step in bringing Saviynt closer to our customers and partners." Heus brings two decades of enterprise cybersecurity sales experience across the Middle East, Africa and Europe. Before joining Saviynt, he served as Vice President, EMEA at Thales, where he led the company's Identity and Access Management business across the region. His previous leadership roles include positions at Centrify, now part of Delinea, and Sophos. He has been based in Dubai for more than a decade and has spent much of his career building cybersecurity businesses and partner networks across the region. For Saviynt, one of the emerging areas Heus will address is the security of AI agents. As autonomous software agents gain access to enterprise applications, systems and data, they introduce identities that need to be discovered, governed and controlled much like traditional human identities. Saviynt's Zuma platform is designed to provide visibility into these AI identities and apply access controls, including least-privilege policies, throughout their lifecycle. "The Middle East and Africa have become one of the fastest-growing cybersecurity markets in the world, and Identity sits right at the centre of it, especially as AI agents enter the enterprise," said Kamel Heus, Vice President of Sales, MEA, Saviynt. Heus said his priorities will include building Saviynt's local presence, expanding its partner ecosystem and helping organisations secure access for both employees and AI-driven systems. With a new regional sales leader and plans to expand in Saudi Arabia and local hosting, Saviynt's move signals a deeper commitment to the MEA market as identity security becomes increasingly intertwined with cloud transformation and enterprise AI adoption.
Carrick Capital Partners closed a $600 million single-asset continuation vehicle for identity security firm Saviynt on 31 August 2026, including a $255 million new investment — the largest in Carrick's history. The structure allowed existing limited partners to either roll equity into the vehicle or realise an 11x gross multiple on Carrick's initial investment. Coller Capital led the vehicle, with HSBC Asset Management as co-lead. The investment formed part of Saviynt's Series B final close and funded a tender offer for employee liquidity. Saviynt recently surpassed $300 million in annual recurring revenue, up from approximately $10 million at Carrick's initial investment. The company has grown bookings by over 80% this year whilst maintaining 96% customer retention. Carrick led Saviynt's $35 million Series A and remained its sole institutional investor until December 2025, when Saviynt raised $700 million at a $3 billion valuation, led by KKR.
Carrick Capital closes $600M continuation vehicle, commits $255M to Saviynt - unite.ai. Carrick Capital Partners said on August 31, 2026 that it has closed a single-asset continuation vehicle for identity security company Saviynt with approximately $600 million in capital commitments, including a new $255 million investment that the firm described as the largest in its history. According to the announcement from the San Francisco and Newport Beach-based growth investment firm, the new vehicle gave Carrick's existing limited partners the option to roll their equity into the continuation vehicle or realize an 11x gross multiple (10x net) on invested capital from Carrick's initial investment in Saviynt. Coller Capital was the lead investor in the vehicle, and HSBC Asset Management acted as co-lead investor. Carrick said the $255 million commitment included meaningful participation from the firm's general partners. How the transaction is structured. Carrick's new investment was made as part of the final close of Saviynt's Series B financing and helped fund a tender offer that provided liquidity to Saviynt employees. The firm said the combined transactions extend its partnership with the identity security company and align it with Saviynt's management team and the company's new Series B investors. A continuation vehicle allows a private equity or growth investor to move an existing portfolio holding into a newly capitalized fund structure, giving current limited partners a choice between cashing out and maintaining exposure to the asset. In this case, Carrick framed the structure around its long-term conviction in Saviynt. Marc McMorris, Carrick's Co-CEO, said the firm's limited partners entrust it to source companies early, concentrate behind its highest-conviction ideas, and build value through operating performance. He said the transaction provided limited partners "a meaningful realization alongside the choice to stay invested in the Company's next chapter." Co-CEO Jim Madden added that the caliber of investors backing the vehicle spoke to the strength of both Saviynt and the Carrick model. Robert W. Baird & Co. served as financial advisor to Carrick. Proskauer Rose LLP served as legal counsel on the continuation vehicle, and Latham & Watkins LLP served as legal counsel on the new investment. Carrick's history with Saviynt. Carrick said it identified Saviynt through its thematic sourcing work in cybersecurity and built a relationship with the founding team before the company raised institutional capital. Carrick led Saviynt's $35 million Series A and remained the company's only institutional investor until its Series B, supporting it with follow-on financings and working with management on leadership expansion, go-to-market, and board development through what the firm calls its ABV, or Approach to Building Value. That Series B arrived on December 9, 2025, when Saviynt announced a $700 million growth equity financing at a valuation of approximately $3 billion. Funds managed by KKR led that round, with participation from Sixth Street Growth and TenEleven, alongside new funding from Carrick as the existing Series A investor. Saviynt said at the time that it had expanded to more than 600 global enterprise customers representing over 20% of Fortune 100 companies, and that the capital would accelerate product development and deepen integrations with hyperscalers, software and SaaS platforms, professional services firms, and value-added resellers. Saviynt's Growth and its AI identity platform. Carrick's announcement said Saviynt recently surpassed $300 million in annual recurring revenue, up from approximately $10 million at the time of Carrick's initial investment, and that the company has grown bookings by more than 80% this year while maintaining a 96% customer retention rate. In a July 28, 2026 announcement, Saviynt also launched Zuma, an enterprise AI identity security platform the company describes as a unified control plane to discover, protect, and govern AI agents, large language models, and non-human identities alongside the human workforce. According to Saviynt, Zuma is organized into three components. Zuma Insights continuously discovers AI agents, LLMs, AI-based applications, and non-human identities across an enterprise, mapping what they access and who owns them. Zuma Access evaluates agent intent, context, permissions, and risk at runtime so that AI agents are authorized only for the actions a specific task requires. Zuma Governance establishes ownership, lifecycle controls, policy guardrails, access reviews, and audit-ready evidence for AI agents and non-human identities. Zuma extends the Saviynt Identity Cloud, which converges identity governance and administration, privileged access management, application access governance, and identity security posture management. Saviynt said Zuma is available now, with a free trial offered. "The defining security problem of the AI era is that enterprises are now accountable for AI agents and non-human identities that act at machine speed," said Sachin Nayyar, Founder and CEO of Saviynt. "The platform we have built solves this problem by providing visibility, protection, and governance." Nayyar said Carrick has been a partner since the company's first institutional round and that the new capital commitment strengthens Saviynt's ability to move faster for customers. Chris Wenner, Managing Director at Carrick and a Saviynt board member, said the firm underwrote the thesis years ago that identity would become the control plane of enterprise security, and that the AI era has proven it. He said Carrick is "tripling down" because it believes Saviynt will be the leader in unified identity. Carrick said the new capital positions Saviynt to accelerate product development across the Identity Cloud and Zuma, extend its work in AI and agentic identity security, and deepen integrations with hyperscalers, SaaS platforms, and global systems integrators, while continuing to serve its enterprise customer base worldwide.
Simeio achieves industry milestone as Saviynt's first Certified PAM Delivery Partner. Certified delivery partner status underscores the company's expertise in delivering real-world Privileged Access Management outcomes that strengthen identity security and reduce cyber risk. ALPHARETTA, Ga - Aug. 26, 2026 - Simeio, a global leader in Identity Security Services, today announced that it is the first recipient of Saviynt's inaugural Certified Privileged Access Management (PAM) Delivery Partner program. The certification status validates the company's ability to successfully design, implement, and deliver enterprise-grade privileged access security solutions for customers. In the modern cybersecurity world, Privileged Access Management remains one of the most critical controls. Organizations globally are continuously tackling threat actors who routinely target privileged credentials across endpoints, servers, applications, and cloud environments as an entry point into organizations. Recognizing this growing need for robust PAM capabilities Simeio strategically pursued the Saviynt certification through a rigorous process that required demonstrated expertise and successful customer delivery experience. To earn the Saviynt Certified PAM Delivery Partner status, Simeio completed critical training and certifications that covered key criteria including - * Foundational PAM capabilities, * Advanced architecture and configuration, * Capacity to independently build and execute real world PAM use cases * Successful delivery of a Saviynt PAM implementation led by the Simeio team. Unlike many certification programs that focus exclusively on coursework, Saviynt's certification framework requires partners to prove their capabilities through successful implementation in a live customer environment. "Becoming the first Saviynt Certified PAM Delivery Partner is a testament to our team's exceptional ability to deliver Privileged Access Management solutions in real-world environments, addressing complex security, integration, and identity challenges for our customers," "With Simeio, clients gain a partner that goes beyond strategy to operationalize security controls and demonstrate a commitment to delivering measurable outcomes that strengthen their overall identity security posture. We thank the Saviynt team for recognizing our team's efforts and capabilities, and we look forward to collaborating to reduce risk, accelerate adoption, and strengthen our customers' overall identity security posture." Nick Rowe, CEO of Simeio. With this certification Simeio will now be able to provide organization with access to teams that have already demonstrated the ability to deploy, optimize, and operate Saviynt PAM solutions in production environments. Some of the benefits clients will experience include: * Architecture informed by real-world deployments, not theoretical designs * Accelerated time-to-value for Saviynt PAM implementations * Use-case-driven deployments tailored to customer requirements, including secrets management, credential rotation, session isolation, and just-in-time access * Proven integration expertise that addresses identity lifecycle, governance, and operational complexities before they impact production environments Simeio's leadership in identity practice has long been established, supporting organizations secure and govern identities across the entire IAM lifecycle. The Saviynt-certified PAM capabilities further strengthens Simeio's ability to provide comprehensive identity security solutions that connect governance, access management, and privileged access controls into a unified identity framework. As organizations continue to modernize their identity security programs, Simeio's expanded partnership with Saviynt ensures customers benefit from privileged access protection delivered by experts who understand the broader identity ecosystem and its role in enterprise resilience. About Simeio Simeio is an award-winning global managed services provider offering Identity and Access Management solutions delivered as a service and interoperable with leading IAM tools. With 700+ employees worldwide, Simeio secures over 160 million identities globally for global large and mid-size enterprises. Services and solutions from Simeio include Customer & Access Management (CIAM), Privileged Access Management (PAM), Identity Proofing, Access Management, Identity Governance & Administration (IGA), Non-human Identity Management, Machine Identity Management, Application Onboarding, and the Simeio Identity Orchestrator for seamless identity operations. The company has been recognized for its business and technical leadership and is highly rated by Gartner, Forrester, and KuppingerCole, and was ranked by Great Places to Work(R). For more information, visit www.simeio.com