Security Analyst – L1( Information Security / Security Operations Center (SOC)

Infinite Computer Solutions Pte Ltd; Singapore; On-site; SGD 60,000 - 90,000; Full time

Job summary

Infinite Computer Solutions Pte Ltd is seeking a proactive Security Analyst – L1 for 24x7 first-level security monitoring across identity, endpoint, email, and cloud platforms in Singapore onsite. You will triage alerts, investigate events, and escalate to L2 engineers for advanced analysis, ensuring timely incident handling and documentation.

The ideal candidate has hands-on experience with Microsoft security technologies, endpoint protection, IAM, Azure monitoring tools, and SOC processes to

Qualifications

• 1–3 years in security operations or SOC roles with hands-on monitoring.
• Experience with Microsoft security technologies and cloud security tooling.
• Familiarity with incident response processes and ticketing systems.

Responsibilities

• Monitor security alerts across identity, endpoint, email and cloud platforms.
• Triage, investigate and escalate incidents following procedures and SLAs.
• Review sign-in logs, MFA events and conditional access issues for anomalies.
• Analyze email threats and escalate high-risk security incidents.
• Monitor endpoint and privileged access events; escalate unusual activity.
• Track cloud security posture using Azure Monitor and Defender dashboards.
• Create and maintain security incident tickets with evidence and timelines.
• Produce daily shift reports and ensure knowledge transfer during handovers.
• Maintain audit-ready documentation and support compliance objectives.

Skills

Security monitoring

Incident management

SLA adherence

Cross-functional collaboration

Education

Bachelor's degree in information security

Relevant security certifications

Tools

Microsoft Entra ID (Azure AD)

Azure Monitor

Azure Log Analytics

Microsoft Defender

Exchange Online Protection

Trend Micro Endpoint Security

CyberArk EPM

CyberArk PAM

EOP

ITSM platforms

Job description

Role: Security Analyst – L1

Location: Singapore (Onsite)

Duration: 12 Months (Renewable) Contract

Department: Information Security / Security Operations Center (SOC)

Experience: 1–3 Years

About the Role

We are seeking a proactive and detail-oriented Security Analyst – L1 to provide 24x7 first-level security monitoring, alert triage, and incident handling across identity, endpoint, email, and cloud security platforms. The role focuses on early threat detection, incident ticket management, security event investigation, and timely escalation of confirmed threats to higher-level security teams.

The ideal candidate will have hands-on experience with Microsoft security technologies, endpoint protection solutions, identity and access management, Azure monitoring tools, and security operations processes. This position plays a critical role in maintaining organizational security posture through continuous monitoring, documentation, and adherence to incident response procedures.

Key Responsibilities

Security Monitoring & Alert Triage

• Monitor security alerts and events across identity, endpoint, email, and cloud security platforms.
• Review and triage security alerts based on defined operational procedures and escalation criteria.
• Perform first-level investigation of suspicious activities and security anomalies.
• Escalate confirmed threats and high-risk incidents to L2 Security Engineers for advanced analysis.

Identity & Access Security Monitoring

• Monitor Microsoft Entra ID sign-in logs and authentication events.
• Investigate suspicious login attempts, account lockouts, and abnormal authentication patterns.
• Monitor Multi-Factor Authentication (MFA) failures and identify potential unauthorized access attempts.
• Validate Conditional Access policy failures and document findings.

Email Security Operations

• Monitor Exchange Online Protection alerts for spam, phishing, malware, and email-based threats.
• Perform initial analysis of suspicious email activities.
• Escalate high-risk email security incidents for further investigation.

Endpoint Security Monitoring

• Monitor endpoint security alerts generated by Trend Micro Endpoint Security solutions.
• Review malware detections, suspicious behaviors, and policy violation alerts.
• Ensure proper ticket creation and escalation for critical endpoint incidents.

Privileged Access & Endpoint Privilege Monitoring

• Monitor CyberArk Endpoint Privilege Manager (EPM) and Privileged Access Management (PAM) alerts.
• Review privileged access activities and identify unusual privilege escalation attempts.
• Escalate suspicious privileged account activities to security engineering teams.

Cloud Security Monitoring

• Monitor Azure security dashboards, Azure Monitor, and Log Analytics workspaces.
• Review cloud security alerts and identify potential threats or misconfigurations.
• Assist in tracking security incidents affecting cloud resources and services.

Incident Management & Documentation

• Create, update, and manage security incident tickets within ITSM platforms.
• Ensure accurate incident classification, documentation, and evidence collection.
• Maintain incident timelines, investigation notes, and closure records.
• Adhere to defined SLAs for ticket acknowledgment, updates, and resolution tracking.

Operational Reporting & Compliance

• Maintain daily security monitoring and shift activity reports.
• Participate in shift handovers and ensure proper knowledge transfer.
• Track certificate expiry notifications and communicate upcoming expirations to the L2 Security team.
• Maintain audit-ready documentation and incident records.

Required Skills & Competencies

Identity & Access Management

• Microsoft Entra ID (Azure AD) administration and monitoring.
• Active Directory authentication monitoring.
• Microsoft Multi-Factor Authentication (MFA).
• Conditional Access monitoring and troubleshooting.

Email Security

• Exchange Online Protection (EOP).
• Spam, phishing, and malware alert analysis.

Endpoint & Privileged Access Security

• Trend Micro Endpoint Security and Email Security.
• CyberArk Endpoint Privilege Manager (EPM).
• CyberArk Privileged Access Management (PAM).

Cloud Security & Monitoring

• Azure Monitor.
• Azure Log Analytics.
• Microsoft Defender (Monitoring and Alert Review).
• Azure security dashboards and monitoring tools.

Security Operations

• Security event monitoring and alert triage.
• Incident handling and escalation procedures.
• Security ticket management and documentation.
• Basic threat detection and analysis techniques.

PKI & Certificate Management

• Basic understanding of Public Key Infrastructure (PKI).
• Certificate lifecycle monitoring and expiry tracking.

IT Service Management

• Experience with ITSM and ticketing platforms.
• Incident tracking, escalation, and SLA management.

Preferred Qualifications

• Microsoft Security, Azure, or Security Operations certifications.
• Basic understanding of SIEM concepts and security monitoring workflows.
• Familiarity with security frameworks such as ISO 27001, NIST, or CIS Controls.
• Knowledge of phishing analysis, malware indicators, and identity-based attacks.
• Experience working in a Security Operations Center (SOC) environment.

Key Performance Indicators (KPIs)

• Security alert triage and response within defined SLA.
• Accuracy of incident classification and escalation.
• Timely creation and maintenance of security tickets.
• Quality of incident documentation and closure notes.
• Shift handover completeness and operational reporting accuracy.
• Compliance with security monitoring procedures and escalation standards.

What Success Looks Like

• Timely detection and escalation of security threats.
• Consistent monitoring coverage across all security platforms.
• Accurate incident documentation and reporting.
• High SLA adherence for security event handling.
• Strong collaboration with L2 Security Engineers and Infrastructure Teams.
• Continuous improvement in threat detection and operational effectiveness.