Cyber Defence SecOps Analyst

iSystems Ltd; Islamabad; On-site; PKR 2,400,000 - 4,200,000; Full time

Job summary

iSystems Ltd. is seeking a skilled Cyber Defence SecOps Analyst to join our security operations team.

You will manage vulnerability assessment and remediation, investigate incidents, and lead threat hunting across endpoint, network, and cloud environments within a global enterprise setup. The role requires hands-on experience with enterprise security tools (Tenable, CrowdStrike Falcon, Darktrace, Microsoft Defender, GitHub Advanced Security) and a strong grasp of risk-based prioritisation,

Qualifications

• 3-5 years of experience in security operations, vulnerability management, or cybersecurity engineering within an enterprise environment.
• Hands-on experience with vulnerability management and security tools such as Tenable, CrowdStrike Falcon, Darktrace, Microsoft Defender, and GitHub Advanced Security; familiarity with Vulcan or similar platforms is preferred.
• Strong understanding of vulnerability assessment and risk-based prioritisation, including CVSS, EPSS, CISA KEV, threat intelligence, and remediation tracking.
• Experience in incident response, security alert triage, and threat hunting across endpoint, network, identity, and cloud environments.
• Working knowledge of Windows, Linux, Azure, networking, enterprise infrastructure, SSDLC, CI/CD, and application security testing methodologies, including SAST, DAST, and SCA.
• Experience with ServiceNow or Jira for ticket management, along with data querying using KQL or SQL and reporting tools such as Excel or Power BI.
• Awareness of emerging cybersecurity threats, including AI-assisted vulnerability discovery, AI-enabled ransomware, and agentic AI abuse.
• Strong analytical, troubleshooting, communication, and stakeholder coordination skills, with the ability to adapt to changing priorities and participate in an on-call rotation.
• Preferred: Financial services or insurance experience, penetration testing, red/purple teaming, AI security testing, CMDB and asset management, scripting using Python or PowerShell, and relevant certifications such as Security+, CySA+, GCIH, OSCP, or vendor-specific security certifications.

Responsibilities

• Analyse and prioritise vulnerabilities from multiple sources, including Tenable, Microsoft Defender, CrowdStrike Falcon, Darktrace, GitHub Advanced Security, and application security testing tools.
• Track vulnerabilities from identification to closure, coordinate remediation with infrastructure, cloud, application, and platform teams, and validate remediation evidence.
• Prioritise exposures based on exploitability, CVSS, EPSS, CISA KEV, threat intelligence, asset criticality, and attack paths.
• Investigate security alerts and suspicious activities across endpoint, network, identity, and cloud environments, supporting incident triage, containment, and escalation.
• Conduct threat hunting using endpoint detection, network monitoring, cloud security, and SIEM data, including investigations into emerging AI-enabled threats.
• Support application security activities, including SAST, DAST, SCA, code review findings, and security testing within CI/CD pipelines.
• Reconcile asset and scan data across security tools and ServiceNow CMDB, identify coverage gaps, and support continuous external attack surface monitoring.
• Troubleshoot security tool integrations, support vulnerability aggregation platforms such as Vulcan, and contribute to automation, scripting, dashboards, and reporting.
• Participate in security testing, purple-team exercises, tool evaluations, and AI-assisted security initiatives.
• Maintain accurate incident records, handover documentation, remediation trackers, and reporting inputs for security governance.
• Participate in a shared 24/7 on-call rota, respond to escalations within agreed timelines, and coordinate with the SOC/MXDR provider and internal security teams.

Skills

Vulnerability management

Security operations

Incident response

Threat hunting

SIEM data analysis

Endpoint detection

Cloud security

CI/CD security

SAST/DAST/SCA

Automation/scripting

On-call coordination

Tools

Tenable

CrowdStrike Falcon

Darktrace

Microsoft Defender

GitHub Advanced Security

Vulcan

Jira

ServiceNow

KQL/SQL

Job description

We are looking for a skilled Cyber Defence SecOps Analyst with experience in security operations, vulnerability management, incident response, and threat hunting. The role will support vulnerability assessment and remediation, security incident investigation, asset and scan coverage management, and security tooling across a global enterprise environment. The ideal candidate should have hands-on experience with enterprise security tools, risk-based vulnerability prioritisation, and security automation, along with the flexibility to support multiple workstreams and participate in a shared 24/7 on-call rota.

Responsibilities

• Analyse and prioritise vulnerabilities from multiple sources, including Tenable, Microsoft Defender, CrowdStrike Falcon, Darktrace, GitHub Advanced Security, and application security testing tools.
• Track vulnerabilities from identification to closure, coordinate remediation with infrastructure, cloud, application, and platform teams, and validate remediation evidence.
• Prioritise exposures based on exploitability, CVSS, EPSS, CISA KEV, threat intelligence, asset criticality, and attack paths.
• Investigate security alerts and suspicious activities across endpoint, network, identity, and cloud environments, supporting incident triage, containment, and escalation.
• Conduct threat hunting using endpoint detection, network monitoring, cloud security, and SIEM data, including investigations into emerging AI-enabled threats.
• Support application security activities, including SAST, DAST, SCA, code review findings, and security testing within CI/CD pipelines.
• Reconcile asset and scan data across security tools and ServiceNow CMDB, identify coverage gaps, and support continuous external attack surface monitoring.
• Troubleshoot security tool integrations, support vulnerability aggregation platforms such as Vulcan, and contribute to automation, scripting, dashboards, and reporting.
• Participate in security testing, purple-team exercises, tool evaluations, and AI-assisted security initiatives.
• Maintain accurate incident records, handover documentation, remediation trackers, and reporting inputs for security governance.
• Participate in a shared 24/7 on-call rota, respond to escalations within agreed timelines, and coordinate with the SOC/MXDR provider and internal security teams.

Requirements

• 3-5 years of experience in security operations, vulnerability management, or cybersecurity engineering within an enterprise environment.
• Hands-on experience with vulnerability management and security tools such as Tenable, CrowdStrike Falcon, Darktrace, Microsoft Defender, and GitHub Advanced Security; familiarity with Vulcan or similar platforms is preferred.
• Strong understanding of vulnerability assessment and risk-based prioritisation, including CVSS, EPSS, CISA KEV, threat intelligence, and remediation tracking.
• Experience in incident response, security alert triage, and threat hunting across endpoint, network, identity, and cloud environments.
• Working knowledge of Windows, Linux, Azure, networking, enterprise infrastructure, SSDLC, CI/CD, and application security testing methodologies, including SAST, DAST, and SCA.
• Experience with ServiceNow or Jira for ticket management, along with data querying using KQL or SQL and reporting tools such as Excel or Power BI.
• Awareness of emerging cybersecurity threats, including AI-assisted vulnerability discovery, AI-enabled ransomware, and agentic AI abuse.
• Strong analytical, troubleshooting, communication, and stakeholder coordination skills, with the ability to adapt to changing priorities and participate in an on-call rotation.
• Preferred: Financial services or insurance experience, penetration testing, red/purple teaming, AI security testing, CMDB and asset management, scripting using Python or PowerShell, and relevant certifications such as Security+, CySA+, GCIH, OSCP, or vendor-specific security certifications.