Cyber Defence SecOps Analyst

Systems Limited; Islamabad; On-site; PKR 1,800,000 - 3,000,000; Full time

Job summary

Systems Limited is seeking a Cyber Defence SecOps Analyst to join our security operations team. You will handle vulnerability management, incident response, threat hunting, and security tooling across a global enterprise environment, with a focus on risk-based prioritisation, remediation tracking, and on-call support.

The role requires hands-on experience with enterprise security tools, vulnerability prioritisation, and automation.

Qualifications

• Experience in security operations and vulnerability management within an enterprise environment.
• Hands-on with vulnerability assessment tools and remediation tracking.
• Incident response, triage, and threat hunting across endpoints, network, identity and cloud.
• Familiarity with security tooling and automation, with on-call rotation experience.

Responsibilities

• Analyse and prioritise vulnerabilities from multiple sources (Ten able, Defender, CrowdStrike, Darktrace, GitHub AS, SAST/DAST/ SCA).
• Coordinate remediation with infrastructure, cloud and application teams; validate remediation evidence.
• Prioritise exposures using CVSS, EPSS, CISA KEV, threat intel, asset criticality and attack paths.
• Investigate security alerts and incidents across endpoints, network, identity, and cloud environments; support triage and containment.
• Conduct threat hunting using EDR, network monitoring, cloud security, and SIEM data; explore AI-enabled threats.

Skills

Security operations

Vulnerability management

Incident response

Threat hunting

Security tooling

Scripting

Analytical thinking

Stakeholder coordination

Tools

Tenable

CrowdStrike Falcon

Darktrace

Microsoft Defender

GitHub Advanced Security

Vulcan

SIEM

Job description

We are looking for a skilled Cyber Defence SecOps Analyst with experience in security operations, vulnerability management, incident response, and threat hunting. The role will support vulnerability assessment and remediation, security incident investigation, asset and scan coverage management, and security tooling across a global enterprise environment. The ideal candidate should have hands‑on experience with enterprise security tools, risk‑based vulnerability prioritisation, and security automation, along with the flexibility to support multiple workstreams and participate in a shared 24/7 on-call rota.

Responsibilities

• Analyse and prioritise vulnerabilities from multiple sources, including Tenable, Microsoft Defender, CrowdStrike Falcon, Darktrace, GitHub Advanced Security, and application security testing tools.
• Track vulnerabilities from identification to closure, coordinate remediation with infrastructure, cloud, application, and platform teams, and validate remediation evidence.
• Prioritise exposures based on exploitability, CVSS, EPSS, CISA KEV, threat intelligence, asset criticality, and attack paths.
• Investigate security alerts and suspicious activities across endpoint, network, identity, and cloud environments, supporting incident triage, containment, and escalation.
• Conduct threat hunting using endpoint detection, network monitoring, cloud security, and SIEM data, including investigations into emerging AI-enabled threats.
• Support application security activities, including SAST, DAST, SCA, code review findings, and security testing within CI/CD pipelines.
• Reconcile asset and scan data across security tools and ServiceNow CMDB, identify coverage gaps, and support continuous external attack surface monitoring.
• Troubleshoot security tool integrations, support vulnerability aggregation platforms such as Vulcan, and contribute to automation, scripting, dashboards, and reporting.
• Participate in security testing, purple-team exercises, tool evaluations, and AI-assisted security initiatives.
• Maintain accurate incident records, handover documentation, remediation trackers, and reporting inputs for security governance.
• Participate in a shared 24/7 on-call rota, respond to escalations within agreed timelines, and coordinate with the SOC/MXDR provider and internal security teams.

Requirements

• 3–5 years of experience in security operations, vulnerability management, or cybersecurity engineering within an enterprise environment.
• Hands‑on experience with vulnerability management and security tools such as Tenable, CrowdStrike Falcon, Darktrace, Microsoft Defender, and GitHub Advanced Security; familiarity with Vulcan or similar platforms is preferred.
• Strong understanding of vulnerability assessment and risk-based prioritisation, including CVSS, EPSS, CISA KEV, threat intelligence, and remediation tracking.
• Experience in incident response, security alert triage, and threat hunting across endpoint, network, identity, and cloud environments.
• Working knowledge of Windows, Linux, Azure, networking, enterprise infrastructure, SSDLC, CI/CD, and application security testing methodologies, including SAST, DAST, and SCA.
• Experience with ServiceNow or Jira for ticket management, along with data querying using KQL or SQL and reporting tools such as Excel or Power BI.
• Awareness of emerging cybersecurity threats, including AI-assisted vulnerability discovery, AI-enabled ransomware, and agentic AI abuse.
• Strong analytical, troubleshooting, communication, and stakeholder coordination skills, with the ability to adapt to changing priorities and participate in an on-call rotation.
• Preferred: Financial services or insurance experience, penetration testing, red/purple teaming, AI security testing, CMDB and asset management, scripting using Python or PowerShell, and relevant certifications such as Security+, CySA+, GCIH, OSCP, or vendor‑specific security certifications.