Cyber Defence SecOps Analyst

iSystems Ltd; Lahore; On-site; PKR 1,200,000 - 2,800,000; Full time

Job summary

iSystems Ltd. is seeking a skilled Cyber Defence SecOps Analyst to join our global security operations team.

You will manage vulnerability assessment, remediation, incident response, threat hunting, and security tooling across enterprise environments, coordinating with infrastructure, cloud, and application teams. Ideal candidates have hands-on experience with Tenable, Defender, CrowdStrike, Darktrace, and GitHub Advanced Security, plus a strong focus on risk-based prioritisation, security

Qualifications

• 3–5 years in security operations or cybersecurity engineering in an enterprise environment.
• Hands-on with vulnerability management and tools listed (Tenable, Defender, CrowdStrike, Darktrace, GitHub Advanced Security).
• Strong risk-based prioritisation using CVSS, EPSS, CISA KEV, threat intel.
• Experience in incident response, alert triage, and threat hunting across endpoints, network, and cloud.
• Knowledge of Windows, Linux, Azure, networking, SDLC, CI/CD, and app security testing (SAST/DAST/SCA).

Responsibilities

• Analyse and prioritise vulnerabilities from multiple sources and coordinate remediation.
• Track vulnerabilities from ID to closure with infrastructure, cloud, app, and platform teams.
• Investigate security alerts and support incident triage, containment, and escalation.
• Conduct threat hunting using EDR, network monitoring, cloud security, and SIEM data.
• Support application security activities in CI/CD pipelines (SAST/DAST/SCA).
• Maintain incident records, handover docs, remediation trackers, and security governance inputs.

Skills

Security ops

Vuln mgmt

Incident response

Threat hunting

SIEM

Endpoint security

Cloud security

CI/CD security

SAST/DAST/SCA

Ticketing (Jira/ServiceNow)

Scripting (Python/PowerShell)

Tools

Tenable

Microsoft Defender

CrowdStrike Falcon

Darktrace

GitHub Advanced Security

Vulcan

Jira

ServiceNow

KQL

SQL

Power BI

Job description

We are looking for a skilled Cyber Defence SecOps Analyst with experience in security operations, vulnerability management, incident response, and threat hunting. The role will support vulnerability assessment and remediation, security incident investigation, asset and scan coverage management, and security tooling across a global enterprise environment. The ideal candidate should have hands-on experience with enterprise security tools, risk-based vulnerability prioritisation, and security automation, along with the flexibility to support multiple workstreams and participate in a shared 24/7 on-call rota.

Responsibilities

• Analyse and prioritise vulnerabilities from multiple sources, including Tenable, Microsoft Defender, CrowdStrike Falcon, Darktrace, GitHub Advanced Security, and application security testing tools.
• Track vulnerabilities from identification to closure, coordinate remediation with infrastructure, cloud, application, and platform teams, and validate remediation evidence.
• Prioritise exposures based on exploitability, CVSS, EPSS, CISA KEV, threat intelligence, asset criticality, and attack paths.
• Investigate security alerts and suspicious activities across endpoint, network, identity, and cloud environments, supporting incident triage, containment, and escalation.
• Conduct threat hunting using endpoint detection, network monitoring, cloud security, and SIEM data, including investigations into emerging AI-enabled threats.
• Support application security activities, including SAST, DAST, SCA, code review findings, and security testing within CI/CD pipelines.
• Reconcile asset and scan data across security tools and ServiceNow CMDB, identify coverage gaps, and support continuous external attack surface monitoring.
• Troubleshoot security tool integrations, support vulnerability aggregation platforms such as Vulcan, and contribute to automation, scripting, dashboards, and reporting.
• Participate in security testing, purple-team exercises, tool evaluations, and AI-assisted security initiatives.
• Maintain accurate incident records, handover documentation, remediation trackers, and reporting inputs for security governance.
• Participate in a shared 24/7 on-call rota, respond to escalations within agreed timelines, and coordinate with the SOC/MXDR provider and internal security teams.

Requirements

• 3-5 years of experience in security operations, vulnerability management, or cybersecurity engineering within an enterprise environment.
• Hands-on experience with vulnerability management and security tools such as Tenable, CrowdStrike Falcon, Darktrace, Microsoft Defender, and GitHub Advanced Security; familiarity with Vulcan or similar platforms is preferred.
• Strong understanding of vulnerability assessment and risk-based prioritisation, including CVSS, EPSS, CISA KEV, threat intelligence, and remediation tracking.
• Experience in incident response, security alert triage, and threat hunting across endpoint, network, identity, and cloud environments.
• Working knowledge of Windows, Linux, Azure, networking, enterprise infrastructure, SSDLC, CI/CD, and application security testing methodologies, including SAST, DAST, and SCA.
• Experience with ServiceNow or Jira for ticket management, along with data querying using KQL or SQL and reporting tools such as Excel or Power BI.
• Awareness of emerging cybersecurity threats, including AI-assisted vulnerability discovery, AI-enabled ransomware, and agentic AI abuse.
• Strong analytical, troubleshooting, communication, and stakeholder coordination skills, with the ability to adapt to changing priorities and participate in an on-call rotation.
• Preferred: Financial services or insurance experience, penetration testing, red/purple teaming, AI security testing, CMDB and asset management, scripting using Python or PowerShell, and relevant certifications such as Security+, CySA+, GCIH, OSCP, or vendor-specific security certifications.