L3 SOC analyst & SOC Lead

INSYGHTS SECURITY PTE. LTD.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

INSYGHTS SECURITY PTE. LTD. is seeking a senior L3 SOC analyst to lead threat hunting, DFIR, and client engagement. You will own complex incidents, hunt proactively, and guide L1/L2 analysts while coordinating with clients.

The role blends hands-on forensics with client-facing leadership, including QBRs and SOC runbook development. Strong MITRE ATT&CK knowledge and MSSP experience are highly valued.

Qualifications

• Bachelor's degree in cybersecurity, computer science or IT, with hands-on SOC work.
• Senior SOC experience, 5–7 years in security operations and 2–3 years at L2/L3; MSSP experience is a plus.

Responsibilities

• Proactively hunt threats across client SIEM, EDR/XDR, and network telemetry using MITRE ATT&CK hypotheses.
• Build and tune SIEM detections and SOAR playbooks; map gaps against ATT&CK.
• Lead complex incident response end-to-end: scoping, containment, eradication, and recovery.
• Conduct host, memory analysis (Volatility3), and network forensics to reconstruct attack timelines.
• Triage malware samples using sandbox and extract IoCs for detections.
• Operate threat intel feeds across client environments to enrich detections.
• Produce incident reports and post-incident reviews for technical teams and boards.
• Mentor L1/L2 analysts and raise team capability.

Skills

Attacker mindset

Calm under pressure

Strong written communication

Coaching mindset

Commercially aware

Adaptable

Education

Bachelor's Degree in Cybersecurity/Computer Science/IT

Diploma with hands-on senior SOC experience

Tools

Microsoft Sentinel

Splunk

IBM QRadar

Elastic (ELK)

TrendAI

CrowdStrike Falcon

Volatility3

YARA

KAPE

Wireshark

PowerShell

Python

Job description

ROLE OVERVIEW

This is a senior role with L3 analyst responsibilities with hands-on SOC management, with the technical depth of an L3 makes you a better operations leader, and the management lens makes you a sharper threat hunter. You are the final escalation point for complex incidents, the owner of threat hunting and detection engineering, and the day-to-day leader of the L1/L2 analyst team. You are equally comfortable doing deep forensic analysis and chairing a client Quarterly Business Review. If you are a senior analyst ready to lead, or someone who refuses to step away from the tools, this role is built for you.

KEY RESPONSIBILITIES

A| Technical — L3 Analyst, Threat Hunting & DFIR

• Proactively hunt for threats across client SIEM, EDR/XDR, and network telemetry using MITREATT&CK-based hypotheses
• Build, tune, and maintain SIEM detection rules and SOAR playbooks; map coverage gaps against the ATT&CK matrix
• Lead complex incident response end-to-end — scoping, containment, eradication, recovery, and post-incident review
• Conduct host, memory(Volatility3), and network forensics to reconstruct attack timelines and identify attacker TTPs
• Triage malware samples using sandbox and static/dynamic analysis; extract IoCs and translate findings into detections
• Consume and operationalise threat intelligence feeds (MISP, commercial TIPs, open-source) across client environments
• Produce clear, accurate incident reports and post-incident reviews suitable for technical teams and client boards
• Mentor L1/L2 analysts on active cases and continuously raise the team's technical capability

B| Management — SOC Operations, Team & Clients

• Lead, develop, and performance-manage the L1 and L2 analyst team; conduct regular 1-to-1s and career development planning
• Manage shift rosters and handovers to maintain 24/7 monitoring coverage across all client environments
• Own client SLAs — track and report on MTTD, MTTA, MTTC, and MTTR; drive continuous improvement where targets are missed
• Develop and maintain SOC runbooks, IR playbooks, escalation procedures, and SOPs
• Act as incident commander during major incidents — coordinating response, managing client comms, and directing remediation
• Produce monthly client security reports and lead Quarterly Business Reviews (QBRs) with client stakeholders
• Oversee the SOC technology stack (SIEM, EDR, SOAR, TIP, ticketing) — licensing, health, configuration, and improvement
• Support pre-sales activities including SOC capability demonstrations and onboarding scoping for new clients

TECHNICAL SKILLS & KNOWLEDGE

• SIEM: Microsoft Sentinel(KQL), Splunk (SPL), IBM QRadar, or Elastic — advanced rule writing, not just usage
• EDR/XDR: TrendAI, CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne — deep investigative and hunting use
• SOAR: Playbook development in Splunk SOAR, Sentinel Logic Apps, Palo Alto XSOAR, or equivalent
• DFIR Tooling: Volatility3, Autopsy/FTK, Velociraptor, KAPE, plaso/log2timeline
• Network Forensics: Wireshark, Zeek, Suricata, NetFlow/IPFIX analysis
• Malware Analysis: Any.run /Cuckoo sandbox, PEStudio, YARA rules, basic static/dynamic analysis
• Frameworks: MITREATT&CK, NIST IR lifecycle, PICERL
• OS Forensics: Windows event logs (Security, Sysmon), registry, prefetch; Linux syslog, bash history
• Active Directory: AD attack paths (Pass-the-Hash, Kerberoasting, DCSync), BloodHound
• Cloud: AWS CloudTrail, Azure Activity/Sign-In Logs, M365 Unified Audit Log
• Scripting: Python or PowerShell for enrichment, automation, and IoC ingestion (advantageous)

COMPETENCIES & SOFT SKILLS

• Attacker mindset — you think like a threat actor to build better detections
• Calm and decisive under pressure; the team and clients look to you when things are serious
• Strong written communication — incident reports and executive summaries that are clear and genuinely useful
• Coaching mindset — you invest in L1/L2 development and take satisfaction in the team improving
• Commercially aware —understands that SOC performance is a business value driver, not just a technical exercise
• Adaptable — able to switch between deep forensic work and a client-facing QBR within the same day

EDUCATION & EXPERIENCE

Education

Bachelor's Degree in Cybersecurity, Computer Science, or IT. Diploma holders with strong hands-on experience at senior SOC level are equally considered.

Experience

5–7 years in security operations, with at least 2–3 years at L2/L3 level. Prior team lead, shift lead, or SOC lead experience is strongly preferred. MSSP experience across multiple client environments is a significant advantage.

PREFERRED CERTIFICATIONS

• GIAC GCIH
• GIAC GCIA
• GIAC GCFA
• GIAC GREM
• GIAC GSOC
• CISSP
• CISM
• CompTIA CySA+
• Microsoft SC-200
• Splunk Power User / Admin
• CompTIA SecurityX
• BTL2 / OSCP (Advantageous)