L2 SOC Analyst/Lead (Microsoft Sentinel)- Immediate Joiner

Neuron Solutions Sdn. Bhd.; Kuala Lumpur; On-site; MYR 100,000 - 190,000; Full time

Job summary

Neuron Solutions Sdn. Bhd. seeks an L2 SOC Analyst/Lead to oversee daily SOC shifts, monitor security alerts, and drive incident response using Microsoft Sentinel and CrowdStrike Falcon EDR. You will guide Tier 1 analysts, review escalations, and ensure adherence to SOC processes.

The role requires 4-5 years in cyber security operations, strong knowledge of SIEM/EDR tooling, and experience with NIST/ISO controls. Occasional collaboration with stakeholders is expected.

Qualifications

• Bachelor's degree in Cyber Security, Information Technology, or related field.
• 4-5 years of cyber security operations experience, including 3-4 years in Tier 2 SOC or IR roles.
• Hands-on Microsoft Sentinel experience: KQL, analytics rules, log onboarding, detection tuning.
• Experience with CrowdStrike Falcon EDR: alert triage, IOC management, detection rules.
• Knowledge of Fortinet FortiGate and network security monitoring.

Responsibilities

• Lead daily SOC shift operations and oversee Tier 1 analysts.
• Monitor security alerts and manage incident escalations within SLAs.
• Triage, investigate, and escalate threats using SIEM and EDR tools.
• Coordinate incident tracking, ticket prioritisation, and workload distribution.
• Provide guidance to Tier 1 analysts and validate investigations.
• Prepare incident reports, shift handover summaries, and security updates.

Skills

SOC operations

Tier 2 SOC

Incident response

Threat hunting

KQL queries

Detection tuning

Policy development

Team leadership

Education

Bachelor's degree in Cyber Security, Information Technology, or related field

Tools

Microsoft Sentinel

CrowdStrike Falcon EDR

Fortinet FortiGate

ITSM platforms

Job description

L2 SOC Analyst/Lead (Microsoft Sentinel)- Immediate Joiner

Lead daily SOC shift operations, overseeing Tier 1 analysts, monitoring security alerts, managing incident escalations, and ensuring timely resolution of security incidents within defined SLAs.

Oversee security monitoring and incident investigations using Microsoft Sentinel SIEM, CrowdStrike Falcon EDR, and ITSM platforms, ensuring effective triage, investigation, and escalation of security threats.

Lead Level 2 incident response activities, including threat analysis, containment, remediation, and root cause analysis (RCA), in accordance with established Cyber Incident Response (CIR) plans.

Coordinate shift handovers, incident tracking, ticket prioritisation, and workload distribution to ensure operational continuity and effective communication between SOC shifts.

Provide technical guidance and support to Tier 1 analysts, reviewing escalated incidents, validating investigation findings, and ensuring adherence to SOC procedures and escalation protocols.

Prepare and review incident reports, shift handover summaries, and weekly and monthly security updates for technical teams, stakeholders, and management.

Monitor Microsoft Entra ID and on-premises Active Directory for suspicious account activity, privilege abuse, MFA gaps, and risky sign-ins, coordinating appropriate investigation and remediation.

Develop, maintain, and improve security policies, incident response playbooks, disaster recovery and business continuity plans, risk registers, and risk management frameworks.

Create and fine-tune Microsoft Sentinel detection rules, KQL queries, automation scripts, and threat-hunting use cases to enhance threat detection and response capabilities.

Requirements

Bachelor's degree in Cyber Security, Information Technology, or a related field.

4-5 years of experience in cyber security operations, including 3-4 years in a Tier 2 SOC, incident response, or security engineering role. Experience working with an MSSP-managed Tier 1 SOC is preferred.

Hands-on experience with Microsoft Sentinel, including KQL queries, analytics rules, log source onboarding, and detection tuning.

Experience with CrowdStrike Falcon EDR or comparable platforms, covering alert triage, IOC management, detection rules, and endpoint protection.

Working knowledge of Fortinet FortiGate firewalls and network security monitoring across multi-site environments.

Proven experience in incident response, threat containment, RCA, and executive-level incident reporting.

Good understanding of NIST CSF, ISO 27001, vulnerability management, compliance audits, and user access reviews.