SOC Analyst

Vurke Inc; Pantai; On-site; MYR 150,000 - 200,000; Full time

Job summary

A cybersecurity firm is looking for a Security Operations Analyst to monitor SIEM alerts, triage security events, and assist in incident response. Candidates should have 1 to 3 years of experience in SOC or IT security. Familiarity with SIEM/EDR tools and strong communication skills are essential. Preferred skills include scripting for automation, with certifications such as Security+ or CySA+. This full-time position has a work location of 'On the road'.

Qualifications

• 1 to 3 years experience in SOC, blue team, or IT security operations.
• Familiarity with SIEM and EDR tools.
• Understanding of MITRE ATT&CK and phishing analysis.

Responsibilities

• Monitor SIEM alerts and triage events per SOPs and SLAs.
• Create tickets, document incidents, and propose control improvements.
• Coordinate with IT and engineering during containment and recovery.

Skills

Monitoring SIEM alerts

Basic threat hunting

Scripting for automation in Python

Strong written communication

Education

Certifications: Security+, CySA+, Microsoft SC-200

Tools

Microsoft Sentinel

Splunk

CrowdStrike

Job description

Role summary

Monitor, triage, and investigate security alerts. Execute playbooks, reduce false positives, and elevate incidents.

Key responsibilities

• Monitor SIEM alerts and triage events per SOPs and SLAs
• Perform basic threat hunting and tune detections with the senior team
• Collect and preserve logs, artifacts, and evidence for investigations
• Create tickets, document incidents, and propose control improvements
• Coordinate with IT and engineering during containment and recovery

Minimum qualifications

• 1 to 3 years in SOC, blue team, or IT security operations
• Familiar with SIEM and EDR tools, basic networking, Windows and Linux basics
• Understanding of MITRE ATT&CK, phishing analysis, and common TTPs
• Strong written communications and shift readiness

Preferred

• Scripting for automation in Python or PowerShell
• Certifications: Security+, CySA+, Microsoft SC-200, AZ-500 or equivalent

Tools

• Microsoft Sentinel or Splunk, Defender or CrowdStrike, Zeek or Suricata, SOAR

KPIs

• Mean time to detect and respond, true positive rate, alert fatigue reduction

Screening questions

• Walk through your triage of a suspicious PowerShell event
• How would you reduce false positives from a noisy rule

Job Type: Full-time

Work Location: On the road