Security Analyst L3

Ensign InfoSecurity; Singapore; On-site; SGD 120,000 - 160,000; Full time

Job summary

Ensign InfoSecurity is seeking a seasoned cybersecurity operations expert to monitor client environments using SIEM, investigate security alerts, and conduct IOC-based threat hunts.

You will map MITRE ATT&CK techniques to real-world incidents, produce escalation reports, and coordinate with CERTs during responses. A strong IIS/EC-Council certification and 6+ years of SOC experience are required.

Qualifications

• Degree in Computer Science, Information Security, or a related discipline.
• Minimum 6 years of experience in cybersecurity operations or SOC.
• Hands-on experience with SIEM platforms and understanding of network, Windows, and Linux infrastructure.
• Hands-on experience with EDR platforms for endpoint detection, investigation, and response.
• Ability to triage, investigate and respond to incidents independently with accurate escalation.
• Experience mapping threats to MITRE ATT&CK and IOC-based threat hunts.
• Clear written and verbal communication; able to brief senior stakeholders.
• GIAC GCIH/EC-Council ECIH or equivalent incident handling certification.

Responsibilities

• Monitor client environments using SIEM to detect, triage, and respond to cybersecurity threats per SOPs.
• Analyse and investigate security alerts; deep-dive log analysis across system and OS layers.
• Map TTPs to MITRE ATT&CK and develop plausible attack-path hypotheses.
• Produce escalation reports; manage triage workflow and improve automation playbooks.
• Conduct IOC-based threat hunts and coordinate with vendors and CERTs during incidents.
• Manage detection use cases, dashboards, and SOAR playbooks; tune detection rules and automation.
• Handle full incident ticket lifecycle from creation to closure and escalation.

Skills

SIEM operations

Threat hunting

Incident response

IOC analysis

MITRE ATT&CK mapping

Education

Bachelor in Computer Science / Information Security

Tools

SIEM platforms

EDR platforms

SOAR platforms

Job description

• Monitor client environments using SIEM platforms to detect, triage, and respond to cybersecurity threats in accordance with agreed SOPs and industry best practices


• Analyse and investigate security alerts; perform deep-dive log analysis across system and OS layers to establish baselines and identify anomalous behaviour


• Map threat tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework and construct plausible attack-path hypotheses to inform containment actions


• Produce escalation reports and notes; manage triage workflow and identify improvements to automation playbooks


• Conduct IOC-based reactive threat hunts against limited TTPs


• Operate SIEM, SOAR, EDR, and wider security tooling within the scope of the service engagement


• Perform indicator of compromise (IOC) searches and triage incoming threat intelligence to assess relevance to client assets


• Coordinate with vendors, external CERTs, and internal business stakeholders during incident response activities


• Manage detection use cases, dashboards, and SOAR playbooks: author and tune detection rules, validate existing content, and implement automation to streamline triage and response


• Manage the full incident ticket lifecycle, including creation, updates, closure, hygiene, and MITRE ATT&CK mapping


• Respond to incidents and critical alerts outside of office hours when required


• Any other tasks as assigned

Requirements

• Degree in Computer Science, Information Security, or a related discipline


• Minimum 6 years of experience in cybersecurity operations or a Security Operations Centre (SOC) environment


• Hands-on experience with SIEM platforms and solid understanding of network, Windows, and Linux infrastructure


• Hands-on experience with EDR platforms for endpoint detection, investigation, and response


• Demonstrated ability to triage, investigate, and respond to security incidents independently, with accurate escalation judgement


• Experience mapping threats to MITRE ATT&CK and conducting IOC-based threat hunts


• Clear written and verbal communication; able to produce structured escalation reports and brief senior stakeholders


• GIAC Certified Incident Handler (GCIH), EC-Council ECIH, or equivalent incident handling certification required

Preferred Skills / Qualities

• Experience with SOAR platforms, playbook development, or automation scripting


• Knowledge of cloud infrastructure security (AWS, Azure, or GCP)


• Familiarity with Threat Intelligence Platforms and IOC management workflows


• Experience with next-generation SIEM, NDR, or ITSM/incident management platforms


• Exposure to OT security monitoring or regulatory frameworks such as NIST CSF, ISO 27001, or GDPR


• CrowdStrike certifications (e.g., CCFA, CCFR) or other vendor product certifications are a plus