SOC Security Analyst

TROYTECH INTERNATIONAL CONSULTING PTE LTD; Singapore; On-site; SGD 70,000 - 110,000; Full time

Job summary

TROYTECH INTERNATIONAL CONSULTING PTE LTD seeks a hands-on SOC Analyst to monitor security events 24x7 using Trend Micro, Microsoft Sentinel, and related tools. You will triage alerts, perform initial containment, and contribute to DLP and vulnerability management programs.

You will collaborate with data owners, HR, and compliance teams to investigate incidents, tune detections, and document findings for audits and management reporting.

Qualifications

• Diploma or Bachelor's degree in Cybersecurity, IT, Computer Science, or related field, or equivalent experience.
• 2–4 years of experience in SOC, security operations, or IT security roles.
• Hands‑on experience with SIEM tools, preferably Microsoft Sentinel, and endpoint or XDR tools, preferably Trend Micro.
• Experience using vulnerability scanners such as Tenable and managing patch processes.
• Understanding of Data Loss Prevention concepts, incident response lifecycle, and MITRE ATT&CK framework.

Responsibilities

• Monitor security events 24x7 using Trend Micro, Microsoft Sentinel, and related tools.
• Triage alerts by analyzing severity and business impact to distinguish true positives.
• Investigate suspicious activities using log analysis, KQL queries, and threat intelligence.
• Escalate incidents to L2/L3 or IR teams with clear evidence for timely resolution.
• Contain incidents, isolate endpoints, or block indicators per playbooks.
• Tune detection rules and alert thresholds to reduce noise and improve accuracy.
• Monitor and triage DLP alerts for unauthorized data transfer or exfiltration.
• Investigate DLP policy violations and escalate incidents as needed.
• Review and adjust DLP policies to minimize false positives.
• Coordinate with data owners, HR, and compliance on confirmed data leakage incidents.
• Report DLP incident trends and policy effectiveness to stakeholders.
• Conduct vulnerability scans using Tenable and review results for risks.
• Prioritize vulnerabilities by CVSS, exploitability, and asset criticality.
• Raise and track remediation tickets to closure; escalate overdue items.
• Manage risk acceptance and exception requests with justification documentation.
• Produce vulnerability and patch compliance reports for management and audits.
• Document incidents in ServiceNow and maintain SOC playbooks and SOPs.
• Prepare shift handover notes and security reports for continuity.
• Support audits, compliance checks, and post-incident reviews to improve security posture.

Skills

KQL queries

Incident response

Analytical thinking

Communication

Education

Bachelor's degree in Cybersecurity / IT / CS

Tools

Microsoft Sentinel

Trend Micro

Tenable

ServiceNow

Job description

Job Summary

You will monitor, detect, triage, and respond to security events 24x7 using Trend Micro, Microsoft Sentinel, and related tools. Support data loss prevention, patch compliance, and vulnerability management to protect sensitive data and remediate threats promptly.

Responsibilities

• Monitor security alerts and dashboards across Trend Micro (Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools to detect threats continuously
• Triage alerts by analyzing severity and business impact to distinguish true positives from false alarms
• Investigate suspicious activities using log analysis, KQL queries, and threat intelligence to identify security incidents
• Escalate confirmed incidents to L2/L3 or incident response teams with clear evidence for timely resolution
• Perform initial containment actions such as isolating endpoints or blocking indicators following SOC playbooks
• Tune detection rules and alert thresholds to reduce noise and improve alert accuracy
• Monitor and triage Data Loss Prevention (DLP) alerts for unauthorized data transfer, sharing, or exfiltration
• Investigate DLP policy violations to determine intent and escalade incidents as necessary
• Review and adjust DLP policies and rules to minimize false positives and enhance detection
• Coordinate with data owners, HR, and compliance teams on confirmed data leakage incidents
• Report on DLP incident trends and policy effectiveness to stakeholders
• Conduct vulnerability scans using Tenable and similar tools and review scan results for risks
• Prioritize vulnerabilities by severity (CVSS), exploitability, and asset criticality to focus remediation efforts
• Raise and track remediation tickets to closure, escalating overdue items to ensure timely fixes
• Manage risk acceptance and exception requests with appropriate justification documentation
• Produce vulnerability and patch compliance reports for management and audit purposes
• Document incidents and investigations accurately in ticketing systems such as ServiceNow
• Maintain SOC playbooks, runbooks, and standard operating procedures (SOPs) to support operations
• Prepare shift handover notes and regular security reports to ensure continuity and transparency
• Support audits, compliance checks, and post-incident reviews to improve security posture

Required competencies and certifications

• Diploma or Bachelor's degree in Cybersecurity, IT, Computer Science, or related field, or equivalent experience
• 2-4 years of experience in SOC, security operations, or IT security roles
• Hands‑on experience with SIEM tools, preferably Microsoft Sentinel, and endpoint or XDR tools, preferably Trend Micro
• Experience using vulnerability scanners such as Tenable and managing patch processes
• Understanding of Data Loss Prevention concepts, incident response lifecycle, and MITRE ATT&CK framework

Preferred competencies and qualifications

• Certifications such as CompTIA Security+, Microsoft SC-200, or Trend Micro certifications
• Additional certifications including CEH, GCIH, GCIA, Tenable certifications, or Azure/AWS security certifications

Skills

Strong knowledge of network, endpoint, cloud, and OSsecurity (Windows, Linux)

Ability to write and read KQL queries and analyse logs

Familiarity with firewalls, IDS/IPS, WAF, EDR/XDR, DLP, and vulnerability scanners

Understanding of CVSS scoring, CVE tracking, and risk-basedremediation prioritisation

Strong analytical thinking, attention to detail, and clearwritten and verbal communication

Ability to work with infrastructure and application teams todrive remediation

Calm and effective under pressure and in shift work