Security Analyst (Intelligence & Operations)

GXS Bank; Petaling Jaya; Sur place; MYR 90 000 - 130 000; Plein temps

Résumé du poste

GXS Bank is seeking an experienced SOC professional to join its Security Operations team in Malaysia. The role focuses on escalation management, forensics, containment, and ongoing threat detection across endpoints, networks, and cloud services.

You will develop SIEM use cases, craft automation, and mentor junior analysts while contributing to continuous improvement of security operations and incident response capabilities.

Qualifications

• Experience in developing SOC use cases in SIEM to correlate diverse logs and investigate security alerts.
• Knowledge of Cyber Threat Intelligence, including threat hunting and actionable recommendations.
• Strong understanding of networking principles (TCP/IP, WANs, LANs, common protocols).
• Understanding threat vectors such as malware, email, and websites at medium to high level.
• Strong knowledge of incident management, malware management and vulnerability management processes.

Responsabilités

• Act as the Tier 2 escalation point for all validated threats filtered by the L1 team.
• Conduct deep-dive forensic analysis on endpoints, memory, and network traffic to identify root causes.
• Lead containment and eradication for multi-stage attacks (e.g., Ransomware, BEC).
• Maintain awareness of current threat landscape including malware, phishing, and APTs.
• Create/review/modify documentation to ensure processes and procedures are up to date.
• Daily/Weekly/Monthly SOC reporting.
• Define, create and maintain SIEM correlation rules and playbooks.

Connaissances

Incident response

Threat hunting

SIEM engineering

EDR & SOAR

MITRE ATT&CK

Forensic analysis

Network fundamentals

Documentation & coaching

Formation

Bachelor's Degree in cybersecurity or related field

Outils

Splunk ES

ServiceNow

SIEM tooling

EDR solutions

SOAR platforms

Description du poste

Responsibilities

1. Advanced Incident Response & Escalation

• Act as the Tier 2 Escalation Point for all validated threats filtered by the L1 team.

• Conduct deep-dive forensic analysis on endpoints, memory, and network traffic to identify root causes.

• Lead containment and eradication efforts for multi-stage attacks (e.g., Ransomware, Business Email Compromise).

• Maintain a comprehensive awareness of the current threat landscape, including malware, phishing attacks, and advanced persistent threats (APTs).

• Create/review/modify documentation as needed, to include any process or procedure and thus ensure it’s up to date and standard

• Daily/Weekly/Monthly SOC Reports.

• Define, create and maintain SIEM correlation rules, customer build documents, security process and procedures.

1. Threat Hunting & Detection Engineering

• Proactively hunt for stealthy threats that bypass automated security controls using the MITRE ATT&CK framework.

• Develop and deploy custom SIEM correlation rules and EDR queries to detect advanced adversary techniques.

• Convert “Tribal Knowledge” into automated Level 1 Playbooks to empower the junior team.

1. Mentorship & Quality Assurance

• Perform “Case Reviews” of L1 investigations to ensure high data quality and provide technical coaching.

• Coordinate with the Global Follow-the-Sun leads to ensure smooth handovers of high-priority incidents.

• Actively participate in post-incident reviews to identify lessons learned and recommend improvements to processes and technologies.

• Provide feedback and recommendations to enhance detection and response capabilities.

• Participate in continuous improvement of security operations processes and toolsets.

• Mentor and train junior analysts, sharing knowledge and best practices to strengthen team capabilities.

Requirements

• Experience in developing SOC use cases in SIEM to correlate diverse logs, including the creation of new monitoring use case logic and enabling effective investigation of security alerts and incidents.

• Knowledge of Cyber Threat Intelligence, including the analysis of intelligence alerts, threat hunting, and providing actionable recommendations.

• Strong understanding of networking principles including TCP/IP, WANs, LANs, and commonly used Internet protocols such as SMTP, HTTP, FTP, POP, LDAP.

• Understanding common threat vectors ie malware, email, and website analysis at a medium to high level.

• Strong understanding of security incident management, malware management and vulnerability management processes.

• Strong knowledge of IT and system administration skills in modern operating systems.

• Exposure to SIEM, EDR, SOAR, TIP, & ServiceNow tools etc is required.

• Ability to remain focused during repetitive monitoring while maintaining a high attention to detail.

• Ability to translate complex technical findings into actionable insights for diverse stakeholders.

• Some experience with cloud service providers like AWS and Azure would prove valuable.

• Experience with Splunk ES would be a plus.

• Bachelor’s Degree in relevant field of studies.

• 3-5 years of experience in a SOC environment or equivalent technical role.

• Valid certification for either CEH/ECIH/CHFI/Any SIEM Technical Certification/Any Firewall Technical Certification/or any other industry-related certificate.

• Demonstrated commitment to continuous learning and intellectual curiosity within the cybersecurity domain.