Security Operations Center Analyst

EPAM Systems; Malaysia; Hybrid; MYR 60,000 - 120,000; Full time

Job summary

EPAM Systems Inc. in Kuala Lumpur is seeking a Security Operations Center Analyst to provide hands-on security monitoring and incident response in a hybrid role.

You will monitor alerts across on-prem and AWS, triage incidents, and support detection tuning while aligning coverage with Sydney business hours. In this role you will investigate suspicious activity, document findings for technical and non-technical stakeholders, and contribute to day-to-day SOC operations and handovers to maintain

Qualifications

• Hands-on SOC experience in security monitoring and incident response.
• Experience with alert monitoring, triage, investigation and escalation of incidents.
• Proficiency with SIEM platforms such as Splunk, QRadar, ArcSight, LogRhythm, Elastic Stack or Wazuh.
• Knowledge of network security, IDS/IPS, firewalls and security event analysis.
• Familiarity with Windows and Linux logs plus network device logging.
• Understanding of endpoint security, identity monitoring and malware basics.
• Clear documentation skills and ability to communicate incidents to technical stakeholders.
• Shift flexibility to support Sydney business hours.

Responsibilities

• Monitor SIEM and security tools for attacks and suspicious activity across environments.
• Triage alerts, confirm severity, identify false positives and eliminate threats.
• Run security investigations, analyze logs and gather evidence for incident response.
• Use SIEM and SOAR platforms to support monitoring, investigation and response workflows.
• Monitor identity and access activity, including suspicious authentication and permission misuse.
• Support threat hunting, threat intelligence and detection tuning as needed.
• Produce investigation summaries and security reports for stakeholders.
• Contribute to day-to-day SOC coverage and handovers to maintain continuity.

Skills

SOC operations

alert triage

incident response

threat hunting

documentation

communication

shift flexibility

Tools

Splunk

IBM QRadar

ArcSight

LogRhythm

Elastic Stack

Wazuh

SOAR (Palo Alto Cortex XSOAR)

AWS GuardDuty

CrowdStrike Falcon

Job description

We are seeking a Security Operations Center Analyst in Kuala Lumpur (Hybrid) to support security coverage aligned to Sydney business hours. You will monitor and triage alerts across on-prem and Amazon Web Services (AWS), investigate suspicious activity, elevate confirmed threats and help tune detections and SOAR playbooks. This is a hands-on operations role in a growing team.

Responsibilities

• Monitor SIEM and security tools for attacks, intrusions and suspicious activity across enterprise environments
• Triage alerts, confirm severity, identify false positives and eliminate validated threats
• Run security investigations, analyze logs and gather evidence to support incident response
• Use SIEM and SOAR platforms to support monitoring, investigation and response workflows
• Monitor identity and access activity, including suspicious authentication and potential permission misuse
• Support threat hunting, threat intelligence and detection tuning as needed
• Produce investigation summaries and security reports for technical and non-technical stakeholders
• Contribute to day-to-day Security Operations Center coverage and handovers to maintain continuity

Requirements

• Hands-on experience in a Security Operations Center, security monitoring or enterprise security operations environment
• Experience with alert monitoring, triage, investigation, false-positive identification and incident escalation
• SIEM experience with platforms such as Splunk, IBM QRadar, ArcSight, LogRhythm, Elastic Stack (ELK) or Wazuh
• Knowledge of cybersecurity fundamentals including network security, firewalls, intrusion detection and prevention systems (IDS/IPS), common attack techniques and detection methods
• Familiarity with Windows and Linux logs plus network device logging and security event analysis
• Understanding of endpoint security, identity and access monitoring, malware fundamentals and security hardening basics
• Clear documentation skills with the ability to communicate incidents and findings to technical stakeholders
• Shift flexibility to support coverage aligned to Sydney business hours. Shift patterns may change based on operational needs

Nice to have

• Experience with endpoint detection and response platforms such as CrowdStrike Falcon Platform or equivalent
• Exposure to SOAR tools such as Palo Alto Cortex XSOAR and cloud security services such as AWS GuardDuty
• Familiarity with Cloud Security Posture Management tools such as Wiz and email security tools such as Proofpoint