Security Analyst

Ensign InfoSecurity; Singapore; In loco; SGD 70.000 - 110.000; Tempo pieno

Descrizione del lavoro

Ensign InfoSecurity in Singapore is seeking a proactive SOC professional to monitor client environments, triage alerts, and coordinate incident response. The role requires hands-on SIEM/EDR experience and collaboration with MSSPs and Ensign delivery teams.

You will analyse security alerts, advise on remediation, and produce incident reports for senior stakeholders while operating in a client-facing, on-site setting.

Competenze

• Degree in Computer Science, Information Security, or related discipline.
• 3 to 7 years of experience in cybersecurity operations or SOC.
• Hands-on experience with SIEM platforms and Windows/Linux infrastructure.

Mansioni

• Monitor client environments using SIEM/EDR to detect, triage, and respond to threats per SOPs.
• Analyse and investigate security alerts escalated from client teams; lead or support incident response through to closure.
• Triage alerts to identify notable items for escalation based on procedures and best practices.
• Advise clients on remediation measures for escalated alerts.
• Respond to incidents outside office hours when required.
• Perform IOC searches and triage threat intel for relevance to client assets.
• Coordinate with client stakeholders during active incidents and programme activities.
• Collaborate with MSSPs and Ensign delivery teams on detection tuning to reduce noise.

Conoscenze

SOC operations

Incident response

Threat analysis

Communication

Formazione

Degree in Computer Science or Information Security

Strumenti

SIEM platforms

SOAR platforms

Threat Intelligence Platform

Descrizione del lavoro

• Monitor client environments using SIEM and/or EDR platforms to detect, triage, and respond to cybersecurity threats in accordance with agreed SOPs and industry best practices
• Analyse and investigate security alerts escalated from client teams, MSSPs, and internal systems; lead or support incident response through to closure
• Triage alerts from the SIEM to identify notable alerts for escalation, based on established operating procedures or industry best practices
• Advise clients on possible follow-up actions and remediation measures for escalated alerts
• Respond to incidents and critical alerts outside of office hours when required
• Perform indicator of compromise (IOC) searches and triage incoming threat intelligence to assess relevance to client assets
• Gather and report on threat intelligence using the client's Threat Intelligence Platform
• Coordinate with client stakeholders including IT, infrastructure, application, and business teams during active incidents and programme activities
• Collaborate with MSSPs and Ensign delivery teams on detection tuning to reduce noise and improve fidelity
• Manage detection use cases, dashboards, and reports on SIEM: perform monthly and ad hoc reviews, validate and maintain existing rules, and develop and implement new use cases
• Manage playbooks, automation scripts, and integrations on SOAR: review, validate, maintain, and develop new playbooks; optimise existing ones for accuracy and efficiency
• Any other tasks as assigned

Requirements

• Degree in Computer Science, Information Security, or a related discipline
• 3 to 7 years of experience in cybersecurity operations or a Security Operations Centre (SOC) environment
• Hands‑on experience with SIEM platforms and solid understanding of network, Windows, and Linux infrastructure
• Experience in security, network, and cyber threat analysis
• Demonstrated ability to triage, investigate, and respond to security incidents independently
• Comfortable operating in a client‑facing, on‑site environment with direct accountability to client stakeholders
• Clear written and verbal communication; able to produce structured incident reports and brief senior stakeholders
• GIAC Certified Incident Handler (GCIH) or equivalent certification required

Preferred Skills / Qualities

• Working knowledge of SOAR platforms; experience with playbook development or automation scripting
• Knowledge of cloud infrastructure security (AWS, Azure, or GCP)
• Familiarity with Threat Intelligence Platforms and IOC management workflows
• Exposure to Singapore regulatory frameworks: CSA advisories, IMDA guidelines, MAS TRM
• Additional certifications such as GCFE, GCFA, OSCP, or vendor product certifications