SOC Developer — Build & Automate Threat Detection

Ensign InfoSecurity; Kuala Lumpur; On-site; MYR 90,000 - 150,000; Full time

Job summary

Ensign InfoSecurity is seeking a SOC Developer in Kuala Lumpur to develop and maintain SIEM/SOAR content, build automation for incident response, and integrate new data sources. You will work with SOC Analysts and Threat Hunters to enhance detection use cases and drive improved incident handling.

The role requires a Bachelor's degree in CS/Cybersecurity/IS and familiarity with SIEM/SOAR platforms, MITRE ATT&CK, and threat intelligence.

Qualifications

• Bachelor's degree in CS, cybersecurity, IS or related field required.
• GIAC GMON, GCDA, GCIA or equivalent certification advantageous.
• Strong knowledge of SIEM/SOAR concepts and incident response workflows.
• Familiarity with MITRE ATT&CK and threat intelligence concepts welcome.

Responsibilities

• Develop, customize, and maintain SIEM/SOAR content (rules, alerts, dashboards).
• Create automation playbooks for incident response to reduce analyst workload.
• Integrate new data sources and ensure parsing, normalization, and enrichment.
• Collaborate with SOC Analysts/Threat Hunters to develop detection use cases.
• Document code, detection logic, use cases, and workflows.
• Contribute to threat lifecycle and incident handling processes.

Skills

Python scripting

JavaScript

Bash

Threat hunting mindset

Education

Bachelor's degree in Computer Science, Cybersecurity, Information Systems

Tools

Splunk

QRadar

ELK

Cortex XSOAR

Splunk Phantom

IBM Resilient

Job description

Ensign InfoSecurity is seeking a SOC Developer in Kuala Lumpur to develop and maintain SIEM/SOAR content, build automation for incident response, and integrate new data sources. You will work with SOC Analysts and Threat Hunters to enhance detection use cases and drive improved incident handling.

The role requires a Bachelor's degree in CS/Cybersecurity/IS and familiarity with SIEM/SOAR platforms, MITRE ATT&CK, and threat intelligence.