Senior SOC Analyst

dacta sg pte. ltd.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

DACTA is seeking a Senior SOC Analyst to join our Security Operations Centre in Singapore. You will monitor, investigate, and respond to complex security incidents while leading a small SOC team to ensure effective day-to-day operations.

You will work with cybersecurity, IT, network, and infrastructure teams to contain, remediate, and prevent threats, applying MITRE ATT&CK and other frameworks. Strong SIEM/EDR skills and incident leadership are essential.

Qualifications

• Bachelor's degree or equivalent experience in cybersecurity/IT.
• 5+ years in SOC operations, security monitoring, or incident response.
• Hands-on monitoring, investigation, and response capabilities.
• Experience with SIEM platforms (Splunk, ArcSight, QRadar, Sentinel).
• Knowledge of MITRE ATT&CK and threat frameworks.

Responsibilities

• Continuously monitor and analyse security events from SIEM, EDR/XDR, firewalls, and IDS/IPS.
• Investigate and respond to security incidents, including high-severity events.
• Conduct detailed analysis of logs, network traffic, and endpoints to determine root causes.
• Perform advanced incident containment, eradication, and recovery actions.
• Conduct threat hunting to identify IOCs, attacker behavior, and threats.
• Develop threat-hunting queries and improve detection techniques.
• Correlate data from multiple sources to spot attack patterns and anomalies.
• Analyse malware, URLs, domains, IPs, and other indicators of compromise when needed.
• Review threat intelligence to identify new attack techniques and indicators.
• Develop and maintain SIEM rules, dashboards, and use cases.
• Tune tools to improve detection accuracy and reduce false positives.
• Collaborate with IT, network, and security teams to remediate incidents.
• Lead SOC activities during major incidents and provide guidance.
• Prepare incident reports and post-incident reviews with root cause analysis.

Skills

Security monitoring

Incident response

Threat hunting

SIEM analysis

Team leadership

Education

Bachelor's degree in Cybersecurity or related field

Tools

Splunk

ArcSight

QRadar

Microsoft Sentinel

EDR/XDR tools

Job description

SUMMARY

DACTA is looking for a highly motivated and experienced Senior SOC Analyst to join our Security Operations Centre (SOC) team. The Senior SOC Analyst will be responsible for monitoring, investigating, analysing, and responding to complex security incidents across various security platforms and technologies, while also managing and leading a small team of SOC Analysts.

The role involves advanced security investigations, incident response, threat hunting, security event analysis, and continuous improvement of security monitoring capabilities. The successful candidate will provide technical guidance and support to the SOC team, ensure effective day-to-day operations, and work closely with cybersecurity, IT, network, infrastructure, and other technical teams to identify, contain, and remediate security threats.

RESPONSIBILITIES

• Continuously monitor and analyse security events and alerts from various sources, including SIEM, EDR/XDR, firewalls, IDS/IPS, endpoint security, network security, and other security infrastructure.
• Investigate and respond to security incidents, including complex and high-severity cybersecurity events.
• Conduct detailed analysis of security events, logs, network traffic, endpoint activities, and other relevant security data to determine the severity, impact, scope, and root cause of incidents.
• Perform advanced incident investigation and determine appropriate containment, eradication, recovery, and remediation actions.
• Conduct threat hunting activities to proactively identify suspicious activities, indicators of compromise (IOCs), attacker behaviours, and potential security threats.
• Develop and utilize threat-hunting queries and techniques to identify emerging threats and malicious activities.
• Analyse and correlate information from multiple security sources to identify attack patterns, anomalies, and potential security incidents.
• Perform analysis of malware, suspicious files, URLs, domains, IP addresses, and other indicators of compromise where required.
• Analyse threat intelligence and security research to identify emerging cybersecurity threats, vulnerabilities attack techniques, and indicators that may affect the organisation or its customers.
• Apply recognised cybersecurity frameworks and methodologies, including MITRE ATT&CK, during security investigations and threat analysis.
• Develop, maintain, and improve SIEM correlation rules, detection rules, dashboards, alerts, and security monitoring use cases.
• Assist in tuning and optimizing security tools and detection mechanisms to improve detection accuracy, reduce false positives, and enhance overall SOC capabilities.
• Identify gaps in existing security monitoring and recommend improvementsto security tools, processes, procedures, and detection capabilities.
• Coordinate with IT, network, infrastructure, application, and other technical teams to facilitate timely investigation, containment, and remediation of security incidents.
• Participate in the management and response of major or critical security incidents and provide technical recommendations to relevant stakeholders.
• Conduct root cause analysis and post-incident reviews and provide recommendations to prevent recurrence of security incidents.
• Prepare and maintain detailed incident reports, investigation findings, root cause analysis, remediation recommendations, and other security documentation.
• Develop and maintain incident response procedures, playbooks, investigation guides, and SOC operational documentation.
• Provide technical guidance and knowledge sharing to SOC team members to improve investigation and incident-handling capabilities.
• Participate in regular SOC meetings, cybersecurity training, tabletop exercises, knowledge-sharing sessions, and continuous improvement initiatives.
• Maintain up-to-date knowledge of cybersecurity threats, vulnerabilities, attack techniques, security technologies, and industry best practices.
• Perform other cybersecurity and SOC-related duties and responsibilities as assigned by management.
• Manage and lead a small team of SOC Analysts to ensure effective day-to-day SOC operations and timely handling of security incidents.

REQUIREMENTS

• Bachelor's degree in Cybersecurity, InformationTechnology, Computer Science, Information Security, or a related field, or equivalent professional experience.
• 5 years or more of relevant experience in SOC operations, cybersecurity, security monitoring, incident response, or a related cybersecurity environment.
• Strong hands-on experience in security monitoring, incident investigation, and incident response.
• Strong experience withSIEM platforms, such as Splunk, ArcSight, QRadar, Microsoft Sentinel, or similar technologies.
• Experience with EDR/XDR, IDS/IPS, firewalls, endpoint security, network security, and other cybersecurity technologies.
• Strong understanding of networking protocols and concepts, including TCP/IP, DNS, HTTP/HTTPS, SMTP, VPN, routing, and network traffic analysis.
• Strong knowledge of Windows and Linux operating systems, including system logs, processes, services, authentication mechanisms, and common security events.
• Strong understanding of common cybersecurity attack vectors and techniques, including malware, phishing, credential compromise, privilege escalation, lateral movement, command and control, data exfiltration, DDoS, and Advanced Persistent Threats (APTs).
• Good knowledge of MITRE ATT&CK and other recognised cybersecurity frameworks and methodologies.
• Experience in threat hunting, IOC analysis, log analysis, event correlation, security investigation, and root cause analysis.
• Experience in developing, tuning, or optimizing SIEM correlation rules, detection rules, alerts, dashboards, and security use cases would be an advantage.
• Knowledge of incident response methodologies and security incident lifecycle management.
• Strong analytical, critical-thinking, and problem-solving skills with excellent attention to detail.
• Good written and verbal communication skills, with the ability to clearly document and communicate technical findings.
• Ability to independently manage multiple security incidents and prioritize tasks according to severity and business impact.
• Strong teamwork and collaboration skills, with the ability to work effectively with cybersecurity, IT, network, infrastructure, and other technical teams.
• Ability to work effectively in a fast-paced.
• Relevant cybersecurity certifications such as Security+, CySA+, GCIH, GCIA, CEH, or equivalent would be an advantage.