L2 SOC Analyst (Security Operations Center)

AGENSI PEKERJAAN TRUST RECRUIT SDN. BHD.; Selangor; On-site; MYR 120,000 - 180,000; Full time

Job summary

AGENSI PEKERJAAN TRUST RECRUIT SDN. BHD. invites an experienced L2 SOC Analyst to join our Security Operations Center. You will lead high-priority investigations, coordinate with multi-client engagements, and drive proactive threat containment.

You will supervise incident response, perform forensics, refine detection rules, and mentor junior analysts while communicating findings to executives.

Qualifications

• Bachelor's degree in cybersecurity, CS, IT or related field.
• 5–6 years in cybersecurity; at least 3 years as L2 SOC Analyst.
• Experience in MSSP or systems integrator environments preferred.
• Strong English and Bahasa Malaysia; Mandarin is a plus.
• Proficient with Windows/Linux, AD, and multi-cloud architectures.
• Hands-on with SIEM/EDR and scripting (Python/PowerShell).

Responsibilities

• Lead advanced incident investigations and determine root cause.
• Perform deep forensic analysis of endpoints and networks.
• Map threats to MITRE ATT&CK and tune SIEM rules.
• Direct containment, eradication, and recovery during incidents.
• Prepare PIRs and present findings to clients and stakeholders.
• Mentor L1 analysts and improve SOC SOPs.

Skills

Cybersecurity expertise

Incident response

Forensics analysis

Threat hunting

English/Bahasa Malaysia communication

Education

Bachelor's Degree in Cybersecurity/CS/IT

Tools

SIEM platforms

EDR platforms

SPL

KQL

Python

PowerShell

Active Directory

AWS

Azure

Job description

L2 SOC Analyst (Security Operations Center)

Role Overview We are seeking an experienced L2 SOC Analyst to serve as a key escalation lead across a diverse, multi-client enterprise portfolio. Moving beyond routine monitoring, you will drive deep-dive digital forensics, advanced incident investigation, and active threat containment. Operating in a high-consequence environment, this role provides an ideal platform to execute proactive threat hunting, optimize detection engineering, and interface directly with enterprise stakeholders during critical security events.

Key Responsibilities

Advanced Incident Investigation: Validate and investigate high-priority alerts escalated by L1 analysts to determine root cause, scope of compromise, and enterprise business impact.

Forensics & Deep Analysis: Conduct complex log analysis, endpoint forensics (EDR/XDR), and network traffic inspection to reconstruct sophisticated attack vectors.

Threat Mapping & Detection Engineering: Correlate security events against the MITRE ATT&CK framework; fine-tune SIEM correlation rules (SPL, KQL) and SOAR playbooks to elevate SOC detection efficacy.

Incident Response Leadership: Direct containment, eradication, and recovery strategies for major cyber threats, including ransomware, advanced persistent threats (APTs), and business email compromise (BEC).

Client Engagement & Stakeholder Reporting: Translate complex technical findings into clear, executive-ready Post-Incident Reviews (PIR) and actionable intelligence for client decision-makers.

SOC Maturity & Mentorship: Provide ongoing technical guidance, refine standard operating procedures (SOPs), and mentor L1 analysts to build team capability.

Qualifications & Requirements

Education: Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, or a related field.

Experience: 5–6 years of progressive cybersecurity experience, with a minimum of 3 years as a Level 2 SOC Analyst within a dedicated SOC environment (MSSP or Systems Integrator experience preferred).

Communication & Languages: Excellent verbal and written communication skills in English and Bahasa Malaysia; professional fluency in Mandarin is a strong advantage for regional client engagements.

Technical Mastery:

Deep knowledge of Windows/Linux internals, Active Directory, and multi-cloud architectures (AWS/Azure).

Hands-on expertise in enterprise SIEM/EDR platforms and SIEM query languages (SPL, KQL).

Solid grasp of Incident Response frameworks (NIST SP 800-61 r2) and scripting languages (Python, PowerShell).

Certifications (Preferred): SANS/GIAC (GCIH, GCIA), Microsoft (SC-200), EC-Council (ECIH, CEH), or CompTIA CySA+.

Important Note: Agensi Pekerjaan Trust Recruit Sdn Bhd is committed to safeguarding your personal data in accordance with the Personal Data Protection Act (PDPA).

Please read our privacy statement on our corporate website www.trustrecruit.com.my

License No. JTKSM 1580