- Investigate alerts escalated from L1 and determine the scope, impact, and severity of potential security incidents.
- Lead incident response activities, including containment, eradication, and recovery, following established playbooks and procedures
- Correlate logs and data from SIEM, EDR, network security tools, and cloud platforms to identify malicious activity and confirm incident root causes.
- Assess threats, vulnerabilities, and exploits affecting the environment, and recommend timely mitigation steps.
- Develop scripts or use automation tools to streamline investigation, enrichment, and reporting tasks.
- Prepare clear and complete incident documentation, including timelines, supporting evidence, and post-incident findings.
- Use threat intelligence to enrich investigations, map activity to MITRE ATT&CK, and identify potential threat actor tactics and techniques.
- Perform targeted IOC based hunting in support of ongoing investigations or emerging threats.
- Work closely with L1 and CSOC teams to provide guidance, escalate complex incidents, and continuously improve SOC processes.
Requirements:
- Degree or Diploma in Computer Science, Computer Engineering, Information Security, or related fields.
- Minimum of 6 years of experience in a Security Operations Centre (SOC), Computer Emergency Response Team (CERT/CIRT), or similar incident response function.
- Solid understanding of security incident investigation, including log analysis, event correlation, and root cause identification.
- Good ability to assess the scope impact, and severity of incidents, and recommend appropriate containment and mitigation measures.
- Hands-on experience responding to incidents such as phishing, malware infections, credential compromise, system misconfigurations, or suspicious network activity.
- Good working knowledge of network protocols, system logs, Windows and Linux operating environments, and common attack techniques.
- Basic scripting capability in languages such as Python, Bash or PowerShell are preferred.
- Familiarity with industry frameworks and standards such as MITRE ATT&CK, Cyber Kill Chain, CVSS, and OWASP Top 10.
- Experience working with SIEM, EDR, and SOAR platforms, and able to tune rules or write basic scripts to improve investigation workflows.
- Ability to document investigations clearly and support evidence collection when required.
- Able to work independently and collaboratively, especially in high-pressure situations.
- Able to work 12-hour shift with shift patterns subject to changes due to operational and business requirements.
Interested candidates kindly submit your updated CV in a Word Format to: [Confidential Information]. Only shortlisted candidates will be notify. Thank you.
