Senior Incident Response Specialist (Platform)

StarHub Ltd; Singapore; On-site; SGD 60,000 - 80,000; Full time

Job summary

A leading telecommunications provider in Singapore is seeking a Senior Analyst – Cyber Security Incident Response. The role involves monitoring and analyzing cybersecurity incidents, supporting the incident lifecycle, and bridging SOC analysts with incident response management. Candidates should possess 2–3 years of experience in SOC or incident response, have hands-on experience with SIEM platforms, and be familiar with threat hunting techniques. This position offers an opportunity to make a significant impact on the organization's cyber resilience.

Qualifications

• 2–3 years of experience in a SOC or Incident Response (L2) environment.
• Intermediate hands-on experience with SIEM platforms.
• Strong understanding of use case creation and MITRE ATT&CK framework mapping.

Responsibilities

• Monitor alerts generated from the SOC/SIEM and perform investigations.
• Review security events from multiple log sources to identify threats.
• Conduct threat hunting using Elastic Stack and related tools.

Skills

Incident response

Cybersecurity analysis

Threat hunting

SIEM platforms

Communication skills

Education

Certifications such as CEH, CompTIA Security+, GCIA, or Elastic Certified Analyst

Tools

Elastic Stack

EDR

NDR

Job description

(This role is based in Malaysia, Petaling Jaya )
The Senior Analyst – Cyber Security Incident Response is responsible for monitoring, detecting, and analysing cybersecurity incidents through the Security Operations Centre (SOC) platform. The role supports the end-to-end incident lifecycle — including triage, investigation, containment, and closure — ensuring timely response to security events and maintaining StarHub’s cyber resilience. This role acts as the Level 2 (L2) Incident Responder, bridging SOC analysts and Incident Response management by performing deep technical analysis and coordinating with internal teams for resolution.

Responsibilities

1. Monitor alerts generated from the SOC/SIEM and perform initial to intermediate-level investigations.
2. Review and validate security events from multiple log sources and identify legitimate threats.
3. Perform deep-dive investigations for incidents involving malware, phishing, insider threats, and cloud breaches.
4. Assist in detection rule creation and tuning under the guidance of senior incident responders.
5. Use frameworks like MITRE ATT&CK for mapping and improving detection quality.
6. Conduct threat hunting using Elastic Stack and related tools.
7. Collaborate with MSSP, CSIRT, and IT infrastructure teams to ensure timely incident handling.
8. Support incident response reporting, evidence collection, and documentation for compliance and audit.
9. Contribute to automation opportunities in detection and response workflows.
10. Participate in training sessions, simulations, and tabletop exercises to enhance readiness.
11. Responsible for the log source onboarding and managing the continuous logs availability on the SIEM platform.

Qualifications

1. 2–3 years of experience in a SOC or Incident Response (L2) environment.
2. Intermediate hands‑on experience with SIEM platforms (Elastic Stack preferred).
3. Exposure to incident triage, malware analysis, phishing response, and log correlation.
4. Strong understanding of use case creation and MITRE ATT&CK framework mapping.
5. Demonstrated ability to analyze complex alerts and distinguish false positives from true incidents.
6. Familiarity with security tools such as EDR, NDR, Cyber security tools and threat intelligence platforms.
7. Good communication and documentation skills for stakeholder updates.
8. Certifications such as CEH, CompTIA Security+, GCIA, or Elastic Certified Analyst preferred.