I51 - Security Analyst (116)

FPT Asia Pacific; Singapore; Presencial; SGD 80 000 - 120 000; Tempo integral

Resumo da oferta

Income is seeking a Cyber Security Analyst to monitor, analyse, triage and resolve security events in a managed SOC. You will strengthen detection capabilities, investigate incidents with stakeholders, and contribute to escalation and documentation processes.

You will work within IT Risk and Security, supporting the Incident Manager and Security Operations Manager while applying emerging threats intelligence to improve monitoring and response.

Qualificações

• Minimum 4 years hands-on information-security experience in a SOC or incident-response role.
• Experience with enterprise SIEM platforms and threat intelligence.
• Ability to analyse large datasets and security technologies; TCP/IP, DNS, firewalls.
• Familiarity with cyber kill chain, TTPs and malware triage; incident handling.
• Strong analytical, problem-solving and collaborative skills.

Responsabilidades

• Monitor, triage, and close security events and alerts from the managed SOC and users.
• Assist Incident Manager in investigating, containing and remediating incidents.
• Enhance SOC detection and response playbooks; maintain escalation and documentation processes.
• Use analytics and data-visualisation to derive insights and correlate data from SIEM and sources.
• Apply AI/ML where appropriate to support real-time investigations and containment.
• Perform digital-forensics analysis with proper evidence handling and chain-of-custody.
• Develop security-monitoring reports and dashboards for asset owners and management.
• Stay current with threats and translate intel into detection improvements.
• Coordinate renewal and maintenance of cybersecurity tools and vendor deliverables.

Conhecimentos

Information security

SIEM

Threat intelligence

Digital forensics

Ferramentas

SIEM platforms

Descrição da oferta de emprego

Description

The Cyber Security Analyst is responsible for continuously monitoring, analysing, triaging and resolving cybersecurity events and alerts generated by Income's SIEM System and other security platforms in a managed SOC environment. The role also strengthens threat detection capabilities by identifying detection gaps, enhancing use cases and improving security monitoring processes. Where an event is confirmed as a security incident, the analyst will work with relevant stakeholders and the Security Operations Manager to investigate, contain, remediate and recover from the incident.

This role sits within the IT Risk and Security Department and reports to the Security Operations Manager.

Key Responsibilities

• Continuously monitor, analyse, triage and close security events, alerts and requests received from the managed SOC, security systems and users.


• Support the Incident Manager and relevant stakeholders in investigating, containing, remediating and recovering from security incidents to minimise business impact.


• Enhance SOC detection and response playbooks, develop new incident-response procedures, and maintain clear processes for escalation, communication, evidence collection and documentation.


• Use analytical and data-visualisation tools to automate analysis, derive insights from large datasets, correlate information across SIEM and other data sources, and investigate anomalous activity against established baselines to determine root cause.


• Apply AI-driven and machine-learning capabilities, where appropriate, to support real-time security investigations, threat triage, containment and remediation, escalating issues when required.


• Apply ethical-hacking knowledge to identify potential threats and vulnerabilities and recommend appropriate remediation measures.


• Perform digital-forensics analysis of security events and alerts while following established evidence-handling and chain-of-custody practices.


• Apply reverse-engineering techniques, where required, to understand software behaviour and support malware analysis.


• Develop security-monitoring reports, metrics and dashboards for asset owners and management.


• Stay current with emerging cyber threats, vulnerabilities, attack techniques and industry developments, and translate relevant intelligence into detection and response improvements.


• Participate in cybersecurity exercises, including cyber-range simulations and business continuity exercises.


• Support cybersecurity projects and perform other duties assigned by the Security Operations Manager.


• Coordinate the renewal and maintenance of cybersecurity tools, including tracking licences, support arrangements and vendor deliverables.

Qualifications

• At least 4 years of hands-on information-security experience in a SOC analyst, incident-response analyst, incident-handler or comparable role. Experience in a financial-institution SOC environment and incident management is preferred.


• Strong hands-on cybersecurity experience with enterprise SIEM platforms, such as Google Security Operations SIEM, together with a sound understanding of the cyber kill chain, tactics, techniques and procedures (TTPs), threat intelligence and malware triage.


• Ability to analyse large datasets and packet-level data, operate network and endpoint security technologies, including NIDS/NIPS, firewalls, HIPS, proxies, anti-malware tools, vulnerability scanners and interpret the security events they generate.


• Strong understanding of common attacks targeting systems, networks and applications.


• Strong knowledge of internet infrastructure, networking and network security, including DNS, DHCP, firewalls, WAF, IDS/IPS, VPN, advanced persistent threats and TCP/IP protocols.


• Relevant industry certifications, such as Certified SOC Analyst (CSA), CISSP, CEH, GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Incident Handler (GCIH), or equivalent, are preferred.


• Strong analytical and problem-solving skills, with a self-motivated, detail-oriented and collaborative approach.


• Malware triage and analysis capability is an advantage.


• Willingness to learn and contribute effectively in a collaborative team environment.


• Ability to remain composed, prioritise effectively and work under pressure during cyber security incident investigation and response.


• Good interpersonal, written and verbal communication skills.