Security Operations Analyst

KRIS INFOTECH PTE. LTD.; Singapore; In loco; SGD 50.000 - 90.000; Tempo pieno

Descrizione del lavoro

KRIS INFOTECH PTE. LTD. seeks a Security Operations professional to monitor alerts from Trend Micro and Microsoft Sentinel, triage incidents, and investigate using log analysis and threat intelligence. You will escalate to L2/L3 and perform initial containment per playbooks, while tuning rules to minimize noise.

The role requires 2–4 years in a SOC or IT security role, with hands-on SIEM experience and familiarity with vulnerability scanners and DLP concepts.

Competenze

• Diploma or Bachelor's degree in Cybersecurity, IT, Computer Science, or a related field (or equivalent experience).
• 2-4 years in a SOC, security operations, or IT security role.
• Hands-on experience with a SIEM (Microsoft Sentinel preferred) and endpoint or XDR tools (Trend Micro preferred).
• Experience with vulnerability scanners (Tenable preferred) and patch management processes.
• Understanding of DLP concepts and tools, and of the incident response lifecycle and MITRE ATT&CK.
• Preferred certifications: CompTIA Security+, Microsoft SC-200, or Trend Micro certifications.
• Nice to have: CEH, GCIH, GCIA, Tenable certifications, or Azure/AWS security certifications.

Mansioni

• Monitor alerts and dashboards across Trend Micro (Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools.
• Triage alerts, separate true from false positives, and prioritise by severity and business impact.
• Investigate suspicious activity using log analysis, KQL queries, and threat intelligence.
• Escalate confirmed incidents to L2/L3 or incident response with clear evidence.
• Carry out initial containment per playbooks, such as isolating endpoints or blocking indicators.
• Tune detection rules and alert thresholds to reduce noise.

Conoscenze

KQL queries

Log analysis

MITRE ATT&CK

Incident response lifecycle

Threat intelligence

Patch management processes

Vulnerability management

DLP concepts

Communication

Formazione

Bachelor's degree in Cybersecurity, IT, or Computer Science

Strumenti

Microsoft Sentinel

Trend Micro XDR/EDR

Tenable

Descrizione del lavoro

Job Description:

Security Monitoring & Incident Response:

• Monitor alerts and dashboards across Trend Micro (e.g. Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools.
• Triage alerts, separate true from false positives, and prioritise by severity and business impact.
• Investigate suspicious activity using log analysis, KQL queries, and threat intelligence.
• Escalate confirmed incidents to L2/L3 or the incident response team with clear evidence.
• Carry out initial containment per playbooks, such as isolating endpoints or blocking indicators.
• Tune detection rules and alert thresholds to reduce noise.

Data Loss Prevention (DLP):

• Monitor and triage DLP alerts for unauthorised transfer, sharing, or exfiltration of sensitive data.
• Investigate policy violations, determine whether they are accidental, negligent, or malicious, and escape as required.
• Review and tune DLP policies and rules to reduce false positives
• Coordinate with data owners, HR, and compliance on confirmed data leakage incidents.
• Report DLP incident trends and policy effectiveness.

Vulnerability Management:

• Run and review vulnerability scans using Tenable and similar tools.
• Prioritise findings by severity (CVSS), exploitability, and asset criticality.
• Raise remediation tickets, track them to closure, and escape overdue items.
• Manage risk acceptance and exception requests with supporting justification.
• Produce vulnerability and patch compliance reports for management and audits.

Documentation & Reporting:

• Document incidents and investigations in the ticketing system (e.g. ServiceNow).
• Maintain SOC playbooks, runbooks, and SOPs.
• Prepare shift handover notes and regular security reports.
• Support audits, compliance checks, and post-incident reviews..

Requirements:

• Diploma or Bachelor's degree in Cybersecurity, IT, Computer Science, or a related field (or equivalent experience).
• 2-4 years in a SOC, security operations, or IT security role.
• Hands-on experience with a SIEM (Microsoft Sentinel preferred) and endpoint or XDR tools (Trend Micro preferred).
• Experience with vulnerability scanners (Tenable preferred) and patch management processes.
• Understanding of DLP concepts and tools, and of the incident response lifecycle and MITRE ATT&CK.
• Preferred certifications: CompTIA Security+, Microsoft SC-200, or Trend Micro certifications.
• Nice to have: CEH, GCIH, GCIA, Tenable certifications, or Azure/AWS security certifications.

Skills:

• Strong knowledge of network, endpoint, cloud, and OS security (Windows, Linux).
• Ability to write and read KQL queries and analyse logs.
• Familiarity with firewalls, IDS/IPS, WAF, EDR/XDR, DLP, and vulnerability scanners.
• Understanding of CVSS scoring, CVE tracking, and risk-based remediation prioritisation.
• Strong analytical thinking, attention to detail, and clear written and verbal communication.
• Ability to work with infrastructure and application teams to drive remediation.
• Calm and effective under pressure and in shift work.

Shift timing:

8:00am-5:00pm or 5:00pm-2:00am, 5 days per week (including weekend and PH).