- Location
- Petaling Jaya (First Avenue), Malaysia
- Type
- Full-time
- Experience
- 1+ years
- Source
- Workday
Description
Responsibilities:
1. Real-Time Triage & Investigation
Monitor SIEM, EDR & XDR dashboards to identify and validate security events in real-time.
Perform deep-dive analysis on suspicious activity using logs, telemetry, and threat intelligence.
Exercise investigative autonomy: Move beyond the initial alert to determine the full scope and "blast radius" of a threat.
Follow established playbooks & runbooks for incident handling and escalation.
Correlate logs from multiple sources to verify incidents.
2. Playbook Execution & Creation
Strictly follow established SOPs and Playbooks to ensure consistent incident handling.
Playbook Authoring: Identify gaps in current processes and draft new playbooks to automate or standardize responses to emerging threats.
Continuously tune and refine existing alerts to reduce false-positive rates (FPrate).
3. Incident Documentation & Escalation
Create detailed, technical tickets that tell the story of an incident from detection to containment.
Effectively escalate critical incidents to L2/L3 teams with a comprehensive briefing of findings.
Maintain seamless communication during shift handovers in our global follow-the-sun rotation.
Communicate with stakeholders about security events.
Requirements:
Basic understanding of TCP/IP, DNS, IDS/IPS, Firewalls, the OSI Model, & Vulnerability scanners.
Understanding common threat vectors (malware, email, and website analysis at a basic level).
Knowledge on Cyber Kill Chain Process and MITRE Attack.
Proficient with Windows Event Logs and Linux command line/log analysis.
Exposure to SIEM, EDR, SOAR, TIP, & ServiceNow tools etc is required.
Ability to remain focused during repetitive monitoring while maintaining a high attention to detail.
Ability to translate complex technical findings into actionable insights for diverse stakeholders.
Some experience with cloud service providers like AWS and Azure would prove valuable.
Experience with Splunk ES would be a plus.
Bachelor’s Degree in relevant field of studies.
1-2 years of experience in a SOC environment or equivalent technical role.
Preferred Certifications: CompTIA Security+, ISC2 CC; Certified SOC Analyst etc
Demonstrated commitment to continuous learning and intellectual curiosity within the cybersecurity domain.