Senior Security Analyst (SOC Level 3)

Ensign InfoSecurity; Kuala Lumpur; On-site; MYR 180,000 - 240,000; Full time

Job summary

Ensign InfoSecurity in Malaysia (Kuala Lumpur) is seeking an experienced Senior Incident Response professional to lead high-severity investigations, conduct forensic analyses, and drive proactive threat hunting within a 24x7 SOC environment.

You will mentor junior analysts, refine detection playbooks, and collaborate with engineering and red/purple teams to validate and strengthen defenses against evolving threats.

Qualifications

• Bachelor's degree in a related field.
• Certifications listed (GIAC GCFA/GCIH/GCIA/GDAT, CISSP, OSCP) are highly preferred.
• Strong hands-on experience with security monitoring and detection tools.

Responsibilities

• Lead high-severity incident response and containment activities across IT and business units.
• Conduct in-depth forensic analysis on endpoints, networks, and logs to determine root causes.
• Develop advanced detection use cases and correlation rules based on threat intel and MITRE ATT&CK.
• Perform proactive threat hunting using SIEM, EDR, and threat intel feeds.
• Review and tune alerts, playbooks, and automation to reduce false positives.
• Mentor L1/L2 analysts and act as escalation point for complex issues.
• Collaborate with red/purple teams and engineering to validate defenses.

Education

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field

Tools

SIEM

EDR

IDS/IPS

SOAR

forensic tools

log analysis

malware analysis

packet inspection

scripting (Python, PowerShell, Bash)

Windows

Linux

cloud monitoring (AWS/Azure)

Job description

Ensign is hiring !**Key Responsibilities:*** Lead high-severity incident response and containment activities, coordinating with stakeholders across IT and business units.* Conduct in-depth forensic analysis on endpoints, networks, and logs to determine the root cause and impact of security incidents.* Develop advanced detection use cases and correlation rules based on threat intelligence and TTPs (MITRE ATT&CK, etc.).* Perform proactive threat hunting using SIEM, EDR, and threat intel feeds to uncover undetected threats.* Review and fine-tune alerts, playbooks, and automation workflows to reduce false positives and improve SOC efficiency.* Mentor L1 and L2 analysts, providing guidance, training, and quality review of investigations.* Serve as a technical escalation point for complex security issues and investigations.* Contribute to incident post-mortems and provide recommendations to improve security posture and processes.* Collaborate with red/purple teams and engineering to simulate attacks and validate defense effectiveness.**Requirements:****Education & Certification:*** Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field.* Strongly preferred certifications:+ **GIAC** (GCFA, GCIH, GCIA, GDAT)+ **CISSP**, **OSCP**, or equivalent**Technical Skills:*** Deep understanding of security monitoring and detection tools (SIEM, EDR, IDS/IPS, SOAR).* Strong hands-on experience in forensic tools, log analysis, malware analysis, and packet inspection.* Solid grasp of attacker tactics, techniques, and procedures (TTPs), threat modeling, and behavior analytics.* Familiarity with scripting or automation (Python, PowerShell, Bash) is an advantage.* Experience with Windows, Linux, and cloud environments (AWS/Azure security monitoring).**Soft Skills:*** Excellent analytical and problem-solving skills.* Strong written and verbal communication, including report writing.* Ability to lead investigations and influence cross-functional teams under pressure.**Preferred Experience:*** 4-6+ years of experience in SOC operations, incident response, or threat detection.* Experience working in or leading incident response within a 24x7 SOC or MSSP environment.* Prior involvement in threat hunting or red/purple team collaboration is a strong plus.**About Ensign InfoSecurity**Ensign InfoSecurity is the largest pure-play cybersecurity service provider in Asia. The company is headquartered in Singapore. We specialise in the provision of these services; cybersecurity advisory and assurance, implementation and management of advanced cybersecurity controls, cybersecurity monitoring, threat hunting, and incident response. Underpinning these competencies is in-house research and development in cybersecurity.We are a technology company with warmth and soul. We are ambitious, propelled by our vision to be the cyber defender of choice, and fueled by the dedication and camaraderie of individuals who are eager to make a difference, and leave their footprints in the industry.If you are a self-motivated curious go-getter, we want You! Join Us!