L3 SOC analyst & SOC Manager

INSYGHTS SECURITY PTE. LTD.

Singapore

On-site

SGD 120,000 - 160,000

Full time

14 days+

Get more replies from employers

Send a job-specific resume in minutes.

Job summary

INSYGHTS SECURITY PTE. LTD. is seeking a senior SOC professional to lead L3 analyst activities, threat hunting, and DFIR operations. You will own threat hunting, incident response, and the day-to-day L1/L2 team leadership, driving detection engineering and client-facing reviews.

The role combines hands-on forensic analysis with management responsibilities, including mentoring staff, maintaining runbooks, and delivering QBRs to clients.

Qualifications

Education: Bachelor's Degree in Cybersecurity, Computer Science, or IT.
5–7 years in security operations with 2–3 years at L2/L3 level.
MSSP experience across multiple client environments is a significant advantage.

Responsibilities

Proactively hunt for threats across client SIEM, EDR/XDR, and network telemetry using MITRE ATT&CK-based hypotheses.
Lead complex incident response end-to-end — scoping, containment, eradication, recovery, and post-incident review.
Mentor L1/L2 analysts on active cases and continuously raise the team's technical capability.
Own client SLAs — track and report on MTTD, MTTA, MTTC, and MTTR; drive continuous improvement where targets are missed.
Develop and maintain SOC runbooks, IR playbooks, escalation procedures, and SOPs.
Act as incident commander during major incidents and coordinate client communications.

Skills

Attacker mindset

Calm under pressure

Strong written communication

Coaching mindset

Commercially aware

Adaptable

Education

Bachelor's Degree in Cybersecurity, Computer Science, or IT

Diploma with senior SOC hands-on experience

Tools

Microsoft Sentinel

Splunk

IBM QRadar

Elastic

CrowdStrike Falcon

Microsoft Defender for Endpoint

SentinelOne

Splunk SOAR

Palo Alto XSOAR

Logic Apps

Volatility3

Autopsy

FTK

Velociraptor

KAPE

plaso

log2timeline

Wireshark

Zeek

Suricata

NetFlow/IPFIX

Any.run

Cuckoo Sandbox

PEStudio

YARA

Job description

ROLE OVERVIEW

This is a senior role withL3 analyst responsibilities with hands-on SOC management, with the technical depth of an L3 makes you a better operations leader, and the management lens makes you a sharper threat hunter. You are the final escalation point for complex incidents, the owner of threat hunting and detection engineering, and the day-to-day leader of the L1/L2 analyst team. You are equally comfortable doing deep forensic analysis and chairing a client Quarterly Business Review. If you are a senior analyst ready to lead, or a manager who refuses to step away from the tools, this role is built for you.

KEY RESPONSIBILITIES

A| Technical — L3 Analyst, Threat Hunting & DFIR

Proactively hunt for threats across client SIEM, EDR/XDR, and network telemetry using MITREATT&CK-based hypotheses

Build, tune, and maintain SIEM detection rules and SOAR playbooks; map coverage gaps against the ATT&CK matrix

Lead complex incident response end-to-end — scoping, containment, eradication, recovery, and post-incident review

Conduct host, memory(Volatility3), and network forensics to reconstruct attack timelines and identify attacker TTPs

Triage malware samples using sandbox and static/dynamic analysis; extract IoCs and translate findings into detections

Consume and operationalise threat intelligence feeds (MISP, commercial TIPs, open-source) across client environments

Produce clear, accurate incident reports and post-incident reviews suitable for technical teams and client boards

Mentor L1/L2 analysts on active cases and continuously raise the team's technical capability

B| Management — SOC Operations, Team & Clients

Lead, develop, and performance-manage the L1 and L2 analyst team; conduct regular 1-to-1s and career development planning

Manage shift rosters and handovers to maintain 24/7 monitoring coverage across all client environments

Own client SLAs — track and report on MTTD, MTTA, MTTC, and MTTR; drive continuous improvement where targets are missed

Develop and maintain SOC runbooks, IR playbooks, escalation procedures, and SOPs

Act as incident commander during major incidents — coordinating response, managing client comms, and directing remediation

Produce monthly client security reports and lead Quarterly Business Reviews (QBRs) with client stakeholders

Oversee the SOC technology stack (SIEM, EDR, SOAR, TIP, ticketing) — licensing, health, configuration, and improvement

Support pre-sales activities including SOC capability demonstrations and onboarding scoping for new clients

TECHNICAL SKILLS & KNOWLEDGE

SIEM: Microsoft Sentinel(KQL), Splunk (SPL), IBM QRadar, or Elastic — advanced rule writing, not just usage

EDR/XDR: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne — deep investigative and hunting use

SOAR: Playbook development in Splunk SOAR, Sentinel Logic Apps, Palo Alto XSOAR, or equivalent

DFIR Tooling: Volatility3,Autopsy/FTK, Velociraptor, KAPE, plaso/log2timeline

Network Forensics: Wireshark, Zeek, Suricata, NetFlow/IPFIX analysis

Malware Analysis: Any.run /Cuckoo sandbox, PEStudio, YARA rules, basic static/dynamic analysis

Frameworks: MITREATT&CK, NIST IR lifecycle, PICERL

OS Forensics: Windows event logs (Security, Sysmon), registry, prefetch; Linux syslog, bash history

Active Directory: AD attack paths (Pass-the-Hash, Kerberoasting, DCSync), BloodHound

Cloud: AWS CloudTrail, Azure Activity/Sign-In Logs, M365 Unified Audit Log

Scripting: Python or PowerShell for enrichment, automation, and IoC ingestion (advantageous)

COMPETENCIES & SOFT SKILLS

Attacker mindset — you think like a threat actor to build better detections

Calm and decisive under pressure; the team and clients look to you when things are serious

Strong written communication — incident reports and executive summaries that are clear and genuinely useful

Coaching mindset — you invest in L1/L2 development and take satisfaction in the team improving

Commercially aware —understands that SOC performance is a business value driver, not just a technical exercise

Adaptable — able to switch between deep forensic work and a client-facing QBR within the same day

EDUCATION & EXPERIENCE

Education

Bachelor's Degree in Cybersecurity, Computer Science, or IT. Diploma holders with strong hands-on experience at senior SOC level are equally considered.

Experience

5–7 years in security operations, with at least 2–3 years at L2/L3 level. Prior team lead, shift lead, or SOC management experience is strongly preferred. MSSP experience across multiple client environments is a significant advantage.

PREFERRED CERTIFICATIONS