Security Analyst L3

Ensign InfoSecurity; Kuala Lumpur; On-site; MYR 120,000 - 190,000; Full time

Job summary

Ensign InfoSecurity is hiring a Senior SOC professional to lead investigation and incident response for high-severity security incidents across clients. You will act as final escalation point, conduct forensic analysis, threat hunting, and develop detection logic and playbooks.

Join a multi-tenant SOC environment with opportunities to mentor junior analysts and contribute to improving tools, data sources, and workflows while aligning with standards like NIST and ISO 27001.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, or related discipline.

Responsibilities

• Lead investigation and incident response activities for high-severity security incidents across multiple clients.

Skills

SIEM

EDR

NDR

SOAR

Python

PowerShell

Education

Bachelor’s degree in Cybersecurity

Computer Science or related

Tools

Splunk

MS Sentinel

QRadar

Google SecOps

Devo

CrowdStrike

SentinelOne

Job description

Ensign is hiring !

Key Responsibilities

• Lead investigation and incident response activities for high-severity or complex security incidents across multiple clients.
• Act as final escalation point for incidents unresolved by Tier 1 and Tier 2 analysts.
• Conduct advanced forensic analysis of logs, network traffic, endpoints, and malware to identify root cause and scope.
• Perform proactive threat hunting based on current threat intelligence, TTPs (MITRE ATT&CK), IOCs, and anomalous behavior.
• Develop and refine detection logic, SIEM correlation rules, and EDR/NDR signatures to enhance SOC effectiveness.
• Support incident containment, eradication, and recovery efforts across diverse client environments.
• Collaborate with Threat Intelligence, Engineering, and IR teams to improve tools, data sources, and workflows.
• Identify gaps in an organization’s measurement metrics, telemetry, and logging capabilities and propose enhancement strategies to achieve the intended outcomes.
• Provide technical leadership and mentorship to junior analysts, supporting their skill development and analysis quality.
• Conduct post-incident reviews and create root cause analysis (RCA) and after-action reports for clients.
• Contribute to playbook creation, tuning, and automation efforts, particularly within SOAR platforms.
• Interface with client security teams, IT teams, and executives to communicate investigation findings, remediation guidance, and strategic improvements.
• Ensure SOC processes align with industry frameworks (e.g., NIST, ISO 27001) and client-specific regulatory requirements (e.g., HIPAA, PCI-DSS).
• Lead purple team exercises or internal red vs. blue simulations to test detection coverage and SOC readiness.

Requirements

• Education & Experience: Bachelor’s degree in Cybersecurity, Computer Science, or related discipline (or equivalent hands‑on experience).
• 4+ years of experience in a SOC or cybersecurity operations role, including experience with incident response and threat hunting.
• Prior experience in an MSSP or multi‑tenant SOC environment is strongly preferred.
• Technical Skills: Deep expertise in security tools: SIEM (e.g., Splunk, MS Sentinel, QRadar, Google SecOps, Devo), EDR (e.g., CrowdStrike, SentinelOne), NDR, SOAR.
• Strong understanding of malware behavior, exploit techniques, persistence mechanisms, and attack chain.
• Advanced knowledge of operating systems (Windows/Linux), networking, firewalls, and cloud security (e.g., Azure, AWS).
• Familiarity with threat modeling, ATT&CK framework, cyber kill chain, and detection engineering.
• Experience with scripting and automation (e.g., Python, Bash, PowerShell) to improve SOC efficiency.
• Certifications (preferred): GIAC certifications (e.g., GCIH, GCFA, GCIA, GDAT, GNFA) Offensive Security (OSCP) or equivalent CompTIA CASP+, CySA+ Microsoft SC-200, Azure Defender certifications.

Key Competencies

• Strong investigative and analytical skills with attention to detail.
• Ability to manage multiple critical incidents and prioritize effectively under pressure.
• Excellent verbal and written communication, especially in client‑facing contexts.
• Leadership and mentoring abilities to upskill junior staff and strengthen SOC maturity.
• Strategic thinking with a continuous improvement mindset.
• High degree of professionalism, discretion, and accountability.

Shift Expectations

Generally operates in a regular business‑hour schedule, but must be available for escalation during critical incidents. May participate in on‑call rotations or emergency response shifts depending on client SLAs.

Career Path

Progression into roles such as SOC Team Lead, Incident Response Manager, Threat Intelligence Lead, or Security Architect, based on leadership, innovation, and impact.

About Ensign InfoSecurity

Ensign InfoSecurity is the largest pure‑play cybersecurity service provider in Asia. The company is headquartered in Singapore. We specialise in the provision of these services; cybersecurity advisory and assurance, implementation and management of advanced cybersecurity controls, cybersecurity monitoring, threat hunting, and incident response. Underpinning these competencies is in‑house research and development in cybersecurity. What Makes Ensign Special? We are a technology company with warmth and soul. We are ambitious, propelled by our vision to be the cyber defender of choice, and fueled by the dedication and camaraderie of individuals who are eager to make a difference, and leave their footprints in the industry. If you are a self‑motivated curious go‑getter, we want You! Join Us!