Security Operations Analyst

Job Description:

Security Monitoring & Incident Response:

• Monitor alerts and dashboards across Trend Micro (e.g. Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools.
• Triage alerts, separate true from false positives, and prioritise by severity and business impact.
• Investigate suspicious activity using log analysis, KQL queries, and threat intelligence.
• Escalate confirmed incidents to L2/L3 or the incident response team with clear evidence.
• Carry out initial containment per playbooks, such as isolating endpoints or blocking indicators.
• Tune detection rules and alert thresholds to reduce noise.

Data Loss Prevention (DLP):

• Monitor and triage DLP alerts for unauthorised transfer, sharing, or exfiltration of sensitive data.
• Investigate policy violations, determine whether they are accidental, negligent, or malicious, and escalate as required.
• Review and tune DLP policies and rules to reduce false positives
• Coordinate with data owners, HR, and compliance on confirmed data leakage incidents.
• Report DLP incident trends and policy effectiveness.

Vulnerability Management:

• Run and review vulnerability scans using Tenable and similar tools.
• Prioritise findings by severity (CVSS), exploitability, and asset criticality.
• Raise remediation tickets, track them to closure, and escalate overdue items.
• Manage risk acceptance and exception requests with supporting justification.
• Produce vulnerability and patch compliance reports for management and audits.

Documentation & Reporting:

• Document incidents and investigations in the ticketing system (e.g. ServiceNow).
• Maintain SOC playbooks, runbooks, and SOPs.
• Prepare shift handover notes and regular security reports.
• Support audits, compliance checks, and post-incident reviews..

Requirements:

• Diploma or Bachelor’s degree in Cybersecurity, IT, Computer Science, or a related field (or equivalent experience).
• 2-4 years in a SOC, security operations, or IT security role.
• Hands-on experience with a SIEM (Microsoft Sentinel preferred) and endpoint or XDR tools (Trend Micro preferred).
• Experience with vulnerability scanners (Tenable preferred) and patch management processes.
• Understanding of DLP concepts and tools, and of the incident response lifecycle and MITRE ATT&CK.
• Preferred certifications: CompTIA Security+, Microsoft SC-200, or Trend Micro certifications.
• Nice to have: CEH, GCIH, GCIA, Tenable certifications, or Azure/AWS security certifications.

Skills:

• Strong knowledge of network, endpoint, cloud, and OS security (Windows, Linux).
• Ability to write and read KQL queries and analyse logs.
• Familiarity with firewalls, IDS/IPS, WAF, EDR/XDR, DLP, and vulnerability scanners.
• Understanding of CVSS scoring, CVE tracking, and risk-based remediation prioritisation.
• Strong analytical thinking, attention to detail, and clear written and verbal communication.
• Ability to work with infrastructure and application teams to drive remediation.

Calm and effective under pressure and in shift work.

Shift timing: 8:00am–5:00pm or 5:00pm–2:00am, 5 days per week (including weekend and PH).