SOC Analyst

OPUS IT Services Pte Ltd; Singapore; On-site; SGD 60,000 - 90,000; Full time

Job summary

OPUS IT Services Pte Ltd is seeking a SOC Analyst to join our 24x7 security operations. You will monitor alerts from Trend Micro, Microsoft Sentinel, and related tools, triage incidents, and coordinate containment according to playbooks.

This role also covers DLP, vulnerability management, and reporting. Candidates should have 2–4 years of SOC experience, a relevant degree, KQL/log analysis proficiency, and hands-on use of SIEMs and vulnerability scanners such as Tenable.

Qualifications

• 2–4 years in a SOC, security operations, or IT security role.
• Hands-on experience with a SIEM (Microsoft Sentinel preferred) and endpoint or XDR tools (Trend Micro preferred).
• Understanding of DLP concepts and the incident response lifecycle and MITRE ATT&CK.
• Certifications such as CompTIA Security+ or Trend Micro/Microsoft certifications are a plus.

Responsibilities

• Monitor alerts and dashboards across Trend Micro, Microsoft Sentinel, and other security tools.
• Triage alerts, separate true from false positives, and prioritise by severity and business impact.
• Investigate suspicious activity using log analysis, KQL queries, and threat intelligence.
• Escalate confirmed incidents to L2/L3 or the incident response team with clear evidence.
• Carry out initial containment per playbooks, such as isolating endpoints or blocking indicators.
• Tune detection rules and alert thresholds to reduce noise.
• Document incidents and investigations in the ticketing system and prepare security reports.

Skills

KQL queries

Log analysis

Incident response

Communication

Shift work

Education

Diploma or Bachelor's degree in Cybersecurity, IT, Computer Science, or related field

Tools

Microsoft Sentinel

Trend Micro

Tenable

ServiceNow

Job description

SOC Analyst

Responsible for 24x7 monitoring, detection, triage, and response to security events across the security stack, including Trend Micro, Microsoft Sentinel (SIEM), and related tools. Also supports data loss prevention (DLP), patch compliance, and vulnerability management, so that threats are detected quickly, weaknesses are remediated on time, and sensitive data stays protected.

Key Responsibilities:

Security Monitoring & Incident Response

Monitor alerts and dashboards across Trend Micro (e.g. Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools

Triage alerts, separate true from false positives, and prioritise by severity and business impact

Investigate suspicious activity using log analysis, KQL queries, and threat intelligence

Escalate confirmed incidents to L2/L3 or the incident response team with clear evidence

Carry out initial containment per playbooks, such as isolating endpoints or blocking indicators

Tune detection rules and alert thresholds to reduce noise

Data Loss Prevention (DLP)

Monitor and triage DLP alerts for unauthorised transfer, sharing, or exfiltration of sensitive data

Investigate policy violations, determine whether they are accidental, negligent, or malicious, and escalated as required

Review and tune DLP policies and rules to reduce false positives

Coordinate with data owners, HR, and compliance on confirmed data leakage incidents

Report DLP incident trends and policy effectiveness

Vulnerability Management

Run and review vulnerability scans using Tenable and similar tools

Prioritise findings by severity (CVSS), exploitability, and asset criticality

Raise remediation tickets, track them to closure, and escalated overdue items

Manage risk acceptance and exception requests with supporting justification

Produce vulnerability and patch compliance reports for management and audits

Documentation & Reporting

Document incidents and investigations in the ticketing system (e.g. ServiceNow)

Maintain SOC playbooks, runbooks, and SOPs

Prepare shift handover notes and regular security reports

Support audits, compliance checks, and post-incident reviews

Qualifications:

Diploma or Bachelor's degree in Cybersecurity, IT, Computer Science, or a related field (or equivalent experience)

2-4 years in a SOC, security operations, or IT security role

Hands-on experience with a SIEM (Microsoft Sentinel preferred) and endpoint or XDR tools (Trend Micro preferred)

Experience with vulnerability scanners (Tenable preferred) and patch management processes

Understanding of DLP concepts and tools, and of the incident response lifecycle and MITRE ATT&CK

Preferred certifications: CompTIA Security+, Microsoft SC-200, or Trend Micro certifications

Nice to have: CEH, GCIH, GCIA, Tenable certifications, or Azure/AWS security certifications

Skills:

Strong knowledge of network, endpoint, cloud, and OS security (Windows, Linux)

Ability to write and read KQL queries and analyse logs

Familiarity with firewalls, IDS/IPS, WAF, EDR/XDR, DLP, and vulnerability scanners

Understanding of CVSS scoring, CVE tracking, and risk-based remediation prioritisation

Strong analytical thinking, attention to detail, and clear written and verbal communication

Ability to work with infrastructure and application teams to drive remediation

Calm and effective under pressure and in shift work