Security Analyst L3

Ensign Services; Rawang; On-site; MYR 120,000 - 180,000; Full time

Job summary

Ensign is seeking a Senior SOC Analyst in Malaysia to lead incident response and threat hunting across multiple clients. You will perform advanced forensic analysis, develop detection logic, and mentor junior analysts in a multi-tenant SOC environment.

The role requires a 4+ year track record in SOC, strong SIEM/EDR skills, and the ability to communicate complex findings to executives and clients. A bachelor’s degree in cybersecurity or related field is required.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, or related discipline (or equivalent hands‑on experience).
• 4+ years of experience in a SOC or cybersecurity operations role, including incident response and threat hunting.
• Prior MSSP or multi-tenant SOC experience is strongly preferred.

Responsibilities

• Lead investigation and incident response activities for high-severity or complex security incidents across multiple clients.
• Act as final escalation point for incidents unresolved by Tier 1 and Tier 2 analysts.
• Conduct advanced forensic analysis of logs, network traffic, endpoints, and malware to identify root cause and scope.
• Perform proactive threat hunting based on current threat intel, TTPs (MITRE ATT&CK), IOCs, and anomalous behavior.
• Develop and refine detection logic, SIEM correlation rules, and EDR/NDR signatures to enhance SOC effectiveness.
• Support incident containment, eradication, and recovery across diverse client environments.
• Collaborate with Threat Intelligence, Engineering, and IR teams to improve tools, data sources, and workflows.
• Identify gaps in telemetry and logging capabilities and propose enhancements.
• Provide technical leadership and mentorship to junior analysts, supporting skill development.
• Conduct post-incident reviews and create RCA and after-action reports for clients.
• Contribute to playbook creation, tuning, and automation, especially within SOAR platforms.
• Interface with client security teams, IT teams, and executives to communicate findings and remediation guidance.
• Ensure SOC processes align with NIST, ISO 27001 and client regulatory requirements (HIPAA, PCI-DSS).
• Lead purple team exercises to test detection coverage and SOC readiness.

Skills

Incident response

Threat hunting

Forensic analysis

Leadership

Mentoring

Client communication

Education

Bachelor's degree in Cybersecurity, Computer Science, or related discipline

Tools

Splunk

MS Sentinel

QRadar

Google SecOps

Devo

CrowdStrike

SentinelOne

NDR

SOAR

Python

Job description

Ensign is hiring !

Key Responsibilities

• Lead investigation and incident response activities for high-severity or complex security incidents across multiple clients.
• Act as final escalation point for incidents unresolved by Tier 1 and Tier 2 analysts.
• Conduct advanced forensic analysis of logs, network traffic, endpoints, and malware to identify root cause and scope.
• Perform proactive threat hunting based on current threat intelligence, TTPs (MITRE ATT&CK), IOCs, and anomalous behavior.
• Develop and refine detection logic, SIEM correlation rules, and EDR/NDR signatures to enhance SOC effectiveness.
• Support incident containment, eradication, and recovery efforts across diverse client environments.
• Collaborate with Threat Intelligence, Engineering, and IR teams to improve tools, data sources, and workflows.
• Identify gaps in an organization’s measurement metrics, telemetry, and logging capabilities and propose enhancement strategies to achieve the intended outcomes.
• Provide technical leadership and mentorship to junior analysts, supporting their skill development and analysis quality.
• Conduct post-incident reviews and create root cause analysis (RCA) and after-action reports for clients.
• Contribute to playbook creation, tuning, and automation efforts, particularly within SOAR platforms.
• Interface with client security teams, IT teams, and executives to communicate investigation findings, remediation guidance, and strategic improvements.
• Ensure SOC processes align with industry frameworks (e.g., NIST, ISO 27001) and client-specific regulatory requirements (e.g., HIPAA, PCI-DSS).
• Lead purple team exercises or internal red vs. blue simulations to test detection coverage and SOC readiness.

Requirements

Education & Experience

• Bachelor’s degree in Cybersecurity, Computer Science, or related discipline (or equivalent hands‑on experience).
• 4+ years of experience in a SOC or cybersecurity operations role, including experience with incident response and threat hunting.
• Prior experience in an MSSP or multi-tenant SOC environment is strongly preferred.

Technical Skills

• Deep expertise in security tools: SIEM (e.g., Splunk, MS Sentinel, QRadar, Google SecOps, Devo), EDR (e.g., CrowdStrike, SentinelOne), NDR, SOAR.
• Strong understanding of malware behavior, exploit techniques, persistence mechanisms, and attack chain.
• Advanced knowledge of operating systems (Windows/Linux), networking, firewalls, and cloud security (e.g., Azure, AWS).
• Familiarity with threat modeling, ATT&CK framework, cyber kill chain, and detection engineering.
• Experience with scripting and automation (e.g., Python, Bash, PowerShell) to improve SOC efficiency.

Certifications (preferred)

• GIAC certifications (e.g., GCIH, GCFA, GCIA, GDAT, GNFA)
• Offensive Security (OSCP) or equivalent
• CompTIA CASP+, CySA+
• Microsoft SC-200, Azure Defender certifications

Key Competencies

• Strong investigative and analytical skills with attention to detail.
• Ability to manage multiple critical incidents and prioritize effectively under pressure.
• Excellent verbal and written communication, especially in client-facing contexts.
• Leadership and mentoring abilities to upskill junior staff and strengthen SOC maturity.
• Strategic thinking with a continuous improvement mindset.
• High degree of professionalism, discretion, and accountability.

Shift Expectations

• Generally operates in a regular business-hour schedule, but must be available for escalation during critical incidents.
• May participate in on-call rotations or emergency response shifts depending on client SLAs.

Career Path

Progression into roles such as SOC Team Lead , Incident Response Manager , Threat Intelligence Lead , Security Architect , based on leadership, innovation, and impact.