SENIOR SOC ANALYST L2

TechLab Security; Shah Alam; On-site; MYR 120,000 - 180,000; Full time

Job summary

TechLab Security Sdn Bhd is seeking a seasoned SOC Lead to drive incident response, triage, and containment for complex security events. You will review escalated events from L1/L2 analysts and mentor junior team members.

The role emphasizes detection engineering, tuning SIEM rules, threat hunting, automation, and performance reporting. A minimum 5 years in SOC, leadership experience, and strong knowledge of SIEM/EDR/XDR are required. This role operates in a challenging 24x7 environment.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, or a related field.
• Minimum 5 years of experience in a SOC environment, with at least 1–2 years in a lead or senior analyst role.

Responsibilities

• Lead and perform triage, containment, and response for complex security incidents.
• Review and validate escalated events from SOC Level 1 analysts.
• Provide guidance and mentoring to L1/L2 team members during incident response.
• Perform forensic analysis, log correlation, and root cause investigation.

Skills

Incident response

Leadership

Analytical thinking

Communication

Mentoring

SIEM/EDR/XDR

Education

Bachelor's degree

Tools

Microsoft Sentinel

QRadar

Splunk

CrowdStrike

SOAR tools

Job description

Jora Malaysia will close on 9th September 2026. Thank you for being with us, we are cheering you on as you continue your career journey.

TechLab Security Sdn Bhd specializes in providing customized cybersecurity solutions tailored to the unique needs of each client. Committed to enabling seamless and secure network management, the company strives to offer peace of mind in today's ever-evolving digital landscape. With a mission centered on security for everyone, TechLab upholds the highest standards by collaborating with talented professionals who share a passion for innovation and protection. By addressing challenges with resilience, TechLab empowers organizations to focus on growth without compromising security.

Key Responsibilities

• Lead and perform triage, containment, and response for complex security incidents.
• Review and validate escalated events from SOC Level 1 analysts.
• Provide guidance and mentoring to L1/L2 team members during incident response.
• Perform forensic analysis, log correlation, and root cause investigation.

Detection Engineering & Optimization

• Refine and tune SIEM detection rules, use cases, and correlation logic.
• Collaborate with Threat Intelligence and Vulnerability Management teams to enrich detection logic.
• Work with security engineers to integrate new data sources into SIEM/XDR.
• Support the SOC Manager in monitoring day-to-day operations and shift performance.
• Deliver knowledge transfer and continuous training for SOC analysts.
• Maintain and improve SOC documentation, SOPs, and incident response playbooks.

Tools, Automation & Threat Hunting

• Use and oversee tools such as Microsoft Sentinel, QRadar, Splunk, CrowdStrike, etc.
• Lead proactive threat hunting exercises and coordinate post-incident reviews.
• Identify and implement automation opportunities in triage and incident workflows.
• Prepare regular SOC performance reports, incident metrics, and SLA compliance dashboards.
• Contribute to the strategic growth of the SOC and its operational maturity.

Required Qualifications

Education & Experience

• Bachelor's degree in Cybersecurity, Computer Science, or a related field.
• Minimum 5 years of experience in a SOC environment, with at least 1–2 years in a lead or senior analyst role.

Technical Skills

• Strong knowledge of SIEMs (Sentinel, QRadar, etc.), EDR/XDR, SOAR platforms, and threat intel tools.
• Familiarity with frameworks such as MITRE ATT&CK, NIST, and the Cyber Kill Chain.
• Hands-on experience with IDS/IPS, packet analysis, log aggregation, and malware triage.
• Capable of scripting or automation (Python, PowerShell, or similar) is a plus.

Soft Skills

• Excellent analytical and problem-solving skills.
• Strong communication and leadership qualities.
• Ability to operate effectively in a high-pressure and 24x7 environment.

Preferred Certifications

• Required: CompTIA CySA+, CEH, or equivalent
• Preferred: Certifications in SIEM platforms or SOC operations (e.g., Microsoft Sentinel, QRadar, Google Chronical SIEM)