L3 SOC analyst & SOC Lead

INSYGHTS SECURITY PTE. LTD.

Singapore

On-site

SGD 120,000 - 180,000

Full time

14 days+

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Job summary

INSYGHTS SECURITY PTE. LTD. is seeking a senior L3 SOC analyst to lead threat hunting, DFIR, and client engagement. You will own complex incidents, hunt proactively, and guide L1/L2 analysts while coordinating with clients.

The role blends hands-on forensics with client-facing leadership, including QBRs and SOC runbook development. Strong MITRE ATT&CK knowledge and MSSP experience are highly valued.

Qualifications

Bachelor's degree in cybersecurity, computer science or IT, with hands-on SOC work.
Senior SOC experience, 5–7 years in security operations and 2–3 years at L2/L3; MSSP experience is a plus.

Responsibilities

Proactively hunt threats across client SIEM, EDR/XDR, and network telemetry using MITRE ATT&CK hypotheses.
Build and tune SIEM detections and SOAR playbooks; map gaps against ATT&CK.
Lead complex incident response end-to-end: scoping, containment, eradication, and recovery.
Conduct host, memory analysis (Volatility3), and network forensics to reconstruct attack timelines.
Triage malware samples using sandbox and extract IoCs for detections.
Operate threat intel feeds across client environments to enrich detections.
Produce incident reports and post-incident reviews for technical teams and boards.
Mentor L1/L2 analysts and raise team capability.

Skills

Attacker mindset

Calm under pressure

Strong written communication

Coaching mindset

Commercially aware

Adaptable

Education

Bachelor's Degree in Cybersecurity/Computer Science/IT

Diploma with hands-on senior SOC experience

Tools

Microsoft Sentinel

Splunk

IBM QRadar

Elastic (ELK)

TrendAI

CrowdStrike Falcon

Volatility3

YARA

KAPE

Wireshark

PowerShell

Python

Job description

ROLE OVERVIEW

This is a senior role with L3 analyst responsibilities with hands-on SOC management, with the technical depth of an L3 makes you a better operations leader, and the management lens makes you a sharper threat hunter. You are the final escalation point for complex incidents, the owner of threat hunting and detection engineering, and the day-to-day leader of the L1/L2 analyst team. You are equally comfortable doing deep forensic analysis and chairing a client Quarterly Business Review. If you are a senior analyst ready to lead, or someone who refuses to step away from the tools, this role is built for you.

KEY RESPONSIBILITIES

A| Technical — L3 Analyst, Threat Hunting & DFIR

Proactively hunt for threats across client SIEM, EDR/XDR, and network telemetry using MITREATT&CK-based hypotheses
Build, tune, and maintain SIEM detection rules and SOAR playbooks; map coverage gaps against the ATT&CK matrix
Lead complex incident response end-to-end — scoping, containment, eradication, recovery, and post-incident review
Conduct host, memory(Volatility3), and network forensics to reconstruct attack timelines and identify attacker TTPs
Triage malware samples using sandbox and static/dynamic analysis; extract IoCs and translate findings into detections
Consume and operationalise threat intelligence feeds (MISP, commercial TIPs, open-source) across client environments
Produce clear, accurate incident reports and post-incident reviews suitable for technical teams and client boards
Mentor L1/L2 analysts on active cases and continuously raise the team's technical capability

B| Management — SOC Operations, Team & Clients

Lead, develop, and performance-manage the L1 and L2 analyst team; conduct regular 1-to-1s and career development planning
Manage shift rosters and handovers to maintain 24/7 monitoring coverage across all client environments
Own client SLAs — track and report on MTTD, MTTA, MTTC, and MTTR; drive continuous improvement where targets are missed
Develop and maintain SOC runbooks, IR playbooks, escalation procedures, and SOPs
Act as incident commander during major incidents — coordinating response, managing client comms, and directing remediation
Produce monthly client security reports and lead Quarterly Business Reviews (QBRs) with client stakeholders
Oversee the SOC technology stack (SIEM, EDR, SOAR, TIP, ticketing) — licensing, health, configuration, and improvement
Support pre-sales activities including SOC capability demonstrations and onboarding scoping for new clients

TECHNICAL SKILLS & KNOWLEDGE

SIEM: Microsoft Sentinel(KQL), Splunk (SPL), IBM QRadar, or Elastic — advanced rule writing, not just usage
EDR/XDR: TrendAI, CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne — deep investigative and hunting use
SOAR: Playbook development in Splunk SOAR, Sentinel Logic Apps, Palo Alto XSOAR, or equivalent
DFIR Tooling: Volatility3, Autopsy/FTK, Velociraptor, KAPE, plaso/log2timeline
Network Forensics: Wireshark, Zeek, Suricata, NetFlow/IPFIX analysis
Malware Analysis: Any.run /Cuckoo sandbox, PEStudio, YARA rules, basic static/dynamic analysis
Frameworks: MITREATT&CK, NIST IR lifecycle, PICERL
OS Forensics: Windows event logs (Security, Sysmon), registry, prefetch; Linux syslog, bash history
Active Directory: AD attack paths (Pass-the-Hash, Kerberoasting, DCSync), BloodHound
Cloud: AWS CloudTrail, Azure Activity/Sign-In Logs, M365 Unified Audit Log
Scripting: Python or PowerShell for enrichment, automation, and IoC ingestion (advantageous)

COMPETENCIES & SOFT SKILLS

Attacker mindset — you think like a threat actor to build better detections
Calm and decisive under pressure; the team and clients look to you when things are serious
Strong written communication — incident reports and executive summaries that are clear and genuinely useful
Coaching mindset — you invest in L1/L2 development and take satisfaction in the team improving
Commercially aware —understands that SOC performance is a business value driver, not just a technical exercise
Adaptable — able to switch between deep forensic work and a client-facing QBR within the same day

EDUCATION & EXPERIENCE

Education

Bachelor's Degree in Cybersecurity, Computer Science, or IT. Diploma holders with strong hands-on experience at senior SOC level are equally considered.

Experience

5–7 years in security operations, with at least 2–3 years at L2/L3 level. Prior team lead, shift lead, or SOC lead experience is strongly preferred. MSSP experience across multiple client environments is a significant advantage.

PREFERRED CERTIFICATIONS