Threat Intelligence Analyst II - SOC Security & Hunting

Ensign InfoSecurity; Selangor; Hybrid; MYR 70,000 - 110,000; Full time

Job summary

Ensign InfoSecurity in Malaysia is seeking an experienced security professional to monitor, investigate and report on threat activity for multiple clients. You will analyze network logs, security events and open-source information to identify risks and generate actionable intelligence.

A strong background in SOC/CERT/CIRT, MITRE ATT&CK familiarity, and ability to communicate findings in technical reports and briefings is essential.

Qualifications

• Degree holder with at least 5 years' of experience in related field and capacity.
• Experience in a Security Operations Centre (SOC) or CERT/CIRT.
• Strong interest in open source research and contextual analysis abilities.
• Understanding of networks, apps, and servers; ability to analyze logs.
• Familiarity with MITRE ATT&CK or cyber kill chain.
• Investigative and analytical problem solving skills.
• Knowledge of vulnerabilities, response, and mitigation in cyber security.
• Certifications such as GCIA, CEH are preferred.
• Experience with OSINT and closed source intelligence processes.
• Ability to research and characterize security threats and indicators.

Responsibilities

• Monitor third party security feeds, forums, and mailing lists to gather information related to the client through automated means.
• Produce intelligence outputs to provide an accurate depiction of the current threat landscape and associated risk through the use of customer, community, and open source reporting.
• Produce actionable intelligence information for delivery to colleagues and customers in the form of technical reports, briefings, and data feeds.
• Review vulnerabilities advisories.
• Review and process threat intelligence reports.
• Perform detailed investigative works into all traffic anomalies against established baselines of individual agencies.
• Assess each event based on factual information and wider contextual information available.
• Review, propose and generate reports to automate or reduce low value event escalations.
• Build rules and intelligence to detect threats and proliferate to all monitored networks.
• Implement detection methods in SIEM Rules, DB scripts etc.
• Periodic analysis of security events, network traffic, and logs to engineer new detection methods.
• Support development of tactics, techniques, and procedures for proactive threat hunting and analysis.
• Assist Security Analysts with investigative works.
• Prepare training programmes for Security Analysts and conduct knowledge sharing sessions.
• Fulfil Change Requests and Service Requests and respond to inquiries regarding detection Use Case.

Skills

Analytical thinking

Open source research

Critical thinking

Log analysis

Threat hunting

Investigative skills

Education

Degree holder

GCIA/CEH certifications preferable

Tools

MITRE ATT&CK framework

Job description

Ensign InfoSecurity in Malaysia is seeking an experienced security professional to monitor, investigate and report on threat activity for multiple clients. You will analyze network logs, security events and open-source information to identify risks and generate actionable intelligence.

A strong background in SOC/CERT/CIRT, MITRE ATT&CK familiarity, and ability to communicate findings in technical reports and briefings is essential.