Responsibilities
- Monitor client environments using SIEM platforms to detect, triage, and respond to cybersecurity threats in accordance with agreed SOPs and industry best practices
- Analyse and investigate security alerts perform deep-dive log analysis across system and OS layers to establish baselines and identify anomalous behaviour
- Map threat tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework and construct plausible attack-path hypotheses to inform containment actions
- Produce escalation reports and notes manage triage workflow and identify improvements to automation playbooks
- Conduct IOC-based reactive threat hunts against limited TTPs
- Operate SIEM, SOAR, EDR, and wider security tooling within the scope of the service engagement
- Perform indicator of compromise (IOC) searches and triage incoming threat intelligence to assess relevance to client assets
- Coordinate with vendors, external CERTs, and internal business stakeholders during incident response activities
- Manage detection use cases, dashboards, and SOAR playbooks: author and tune detection rules, validate existing content, and implement automation to streamline triage and response
- Manage the full incident ticket lifecycle, including creation, updates, closure, hygiene, and MITRE ATT&CK mapping
- Respond to incidents and critical alerts outside of office hours when required
- Any other tasks as assigned
Requirements
- Degree in Computer Science, Information Security, or a related discipline
- Minimum 6 years of experience in cybersecurity operations or a Security Operations Centre (SOC) environment
- Hands-on experience with SIEM platforms and solid understanding of network, Windows, and Linux infrastructure
- Hands-on experience with EDR platforms for endpoint detection, investigation, and response
- Demonstrated ability to triage, investigate, and respond to security incidents independently, with accurate escalation judgement
- Experience mapping threats to MITRE ATT&CK and conducting IOC-based threat hunts
- Clear written and verbal communication able to produce structured escalation reports and brief senior stakeholders
- GIAC Certified Incident Handler (GCIH), EC-Council ECIH, or equivalent incident handling certification required
Preferred Skills / Qualities
- Experience with SOAR platforms, playbook development, or automation scripting
- Knowledge of cloud infrastructure security (AWS, Azure, or GCP)
- Familiarity with Threat Intelligence Platforms and IOC management workflows
- Experience with next-generation SIEM, NDR, or ITSM/incident management platforms
- Exposure to OT security monitoring or regulatory frameworks such as NIST CSF, ISO 27001, or GDPR
- CrowdStrike certifications (e.g., CCFA, CCFR) or other vendor product certifications are a plus
Other Special Working Conditions
- Able to perform 12-hour shift duties (2 days work with 2 off-days). Working hours: AM - 8:30am to 8:30pm PM - 8:30pm to 8:30am. Shift patterns and duration may vary from time to time
