L2 SOC ANALYST LEAD (GOVERNMENT SECURITY CLEARANCE PREFFERED)

AKERA TECHNOLOGIES PTE. LTD.; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

AKERA TECHNOLOGIES PTE. LTD. in Singapore seeks an L2 SOC Lead with active threat hunting, incident response and team leadership to manage a 5-8 member SOC serving government and critical infrastructure sectors.

The role requires 24/7 shift coverage, front client engagements, and ongoing threat intelligence gathering. You will perform advanced triage, conduct forensic investigations, develop detection rules, and participate in governance and compliance with IM8/NIST/CSA.

Qualifications

• 5+ years in SOC roles with 2+ years leading teams in 24/7 environments.
• Experience in incident triage, investigations, and threat hunting using MITRE ATT&CK.
• Proven ability to present findings to clients and stakeholders.
• Knowledge of compliance frameworks including IM8, NIST 800-53, CSA CSA Act.
• Active security clearance and GovTech IAM/CSA familiarity would be advantageous.

Responsibilities

• Lead daily shift operations with accountability for incident SLA adherence (MTTR < 15 mins for P1 cases).
• Mentor L1 analysts in alert validation, triage techniques, and playbook execution.
• Conduct purple team exercises quarterly to validate detection capabilities.
• Perform deep-dive investigations (memory/disk forensics, malware analysis) using tools: EDR, SIEM, network-analysis.

Skills

Threat hunting

Incident response

Team leadership

Client engagement

SOC operations

Tools

CrowdStrike

SentinelOne

Splunk ES

QRadar

Wireshark

Corelight

YARA

Sigma

Job description

Job Overview

We seek an L2 SOC Lead with active threat hunting, incident response, and team leadership experience to manage a 5-8 member SOC team serving government and critical infrastructure sectors. Operating in 24/7 shifts, you will perform advanced triage, conduct forensic investigations, front client engagements, and maintain active cyber community involvement for real-time threat intelligence. This role requires SC clearance and deep expertise in GovTech IM8/CSArequirements.

Duties and Responsibilities

Threat Operations Leadership

• 1.Lead daily shift operations with accountability for incident SLA adherence (MTTR< 15 mins for P1 cases).


• 2.MentorL1 analysts in alert validation, triage techniques, and playbook execution.


• 3.Conduct purple team exercises quarterly to validate detection capabilities.

Advanced Security Operations

• 1.Perform deep-dive investigations (memory/disk forensics, malware analysis) using tools:


• 2.EDR(CrowdStrike/SentinelOne)


• 3.SIEM(Splunk ES/QRadar with SOAR integration)


• 4.Networkanalysis (Wireshark, Corelight)


• 5.Lead proactive threat hunts using MITRE ATT&CK frameworks and threatintelligence.


• 6.Develop custom detection rules (YARA, Sigma) for APT groups targeting SEA.

Client& Governance

• 1.Front incident response briefings for customers & stakeholders


• 2.Present monthly SOC reports to clients (threat trends, gap analysis, KPIs).


• 3.Ensure compliance with IM8, NIST 800-53, and CSA Cybersecurity Act.

Threat Intelligence Integration

• Maintain participation in:


• 1.ASEANCERT communities


• 2.Threat intel platforms (MISP, ThreatConnect)


• 3.Industrygroups (ISC2 Singapore, ACSC Partnership Program)


• 4.Disseminate actionable IOCs to team during shifts.

Requirements

Technical Competencies

Must-Have Tools Expertise

• 1.Incident Response - Velociraptor, Autopsy, SIFT Workstation


• 2.Threat Hunting - Atomic Red Team, Kestrel analytics, ELK stack


• 3.Forensics- Volatility, Rekall, FTK Imager


• 4.CTI Management - MISP taxonomies, STIX/TAXII feeds, OpenCTI

Certifications

• 1.Required: CISSP, GCIH/GCFA, SC Security Clearance

Leadership& Experience

• 1.5+years in SOC roles with 2+ years leading teams in 24/7 environments.


• 2.Proven track record:


• 3.Managed≥200 critical incidents annually


• 4.Reduced false positives by ≥40% through detection engineering


• 5.Led threat hunts uncovering ≥3 advanced persistent threats


• 6.Government project experience (IM8, CSA Cyber Essentials, or equivalent).

Shift& Engagement Requirements

• 1.Willingness for 12-hour rotational shifts (including nights/weekends).


• 2.Monthly presentation of SOC reports to client CISOs.


• 3.Quarterly threat briefings at events (e.g., GovWare, Cyber Security ASEAN).