Kerja Sepenuh Masa L3 SOC analyst - SOC Lead, Gaji tinggi SGD 5,000 di INSYGHTS SECURITY PTE. LTD. Central Region (Singapore) - Maukerja

ROLE OVERVIEW

This is a senior role with L3 analyst responsibilities with hands-on SOC management, with the technical depth of an L3 makes you a better operations leader, and the management lens makes you a sharper threat hunter. You are the final escalation point for complex incidents, the owner of threat hunting and detection engineering, and the day-to-day leader of the L1/L2 analyst team. You are equally comfortable doing deep forensic analysis and chairing a client Quarterly Business Review. If you are a senior analyst ready to lead, or someone who refuses to step away from the tools, this role is built for you.

KEY RESPONSIBILITIES

A |  Technical — L3 Analyst, Threat Hunting & DFIR

•       Proactively hunt for threats across client SIEM, EDR/XDR, and network telemetry using MITREATT&CK-based hypotheses

•       Build, tune, and maintain SIEM detection rules and SOAR playbooks; map coverage gaps against the ATT&CK matrix

•       Lead complex incident response end-to-end — scoping, containment, eradication, recovery, and post-incident review

•       Conduct host, memory(Volatility3), and network forensics to reconstruct attack timelines and identify attacker TTPs

•       Triage malware samples using sandbox and static/dynamic analysis; extract IoCs and translate findings into detections

•       Consume and operationalise threat intelligence feeds (MISP, commercial TIPs, open-source) across client environments

•       Produce clear, accurate incident reports and post-incident reviews suitable for technical teams and client boards

•       Mentor L1/L2 analysts on active cases and continuously raise the team's technical capability

B |  Management — SOC Operations, Team & Clients

•       Lead, develop, and performance-manage the L1 and L2 analyst team; conduct regular 1-to-1s and career development planning

•       Manage shift rosters and handovers to maintain 24/7 monitoring coverage across all client environments

•       Own client SLAs — track and report on MTTD, MTTA, MTTC, and MTTR; drive continuous improvement where targets are missed

•       Develop and maintain SOC runbooks, IR playbooks, escalation procedures, and SOPs

•       Act as incident commander during major incidents — coordinating response, managing client comms, and directing remediation

•       Produce monthly client security reports and lead Quarterly Business Reviews (QBRs) with client stakeholders

•       Oversee the SOC technology stack (SIEM, EDR, SOAR, TIP, ticketing) — licensing, health, configuration, and improvement

•       Support pre-sales activities including SOC capability demonstrations and onboarding scoping for new clients

TECHNICAL SKILLS & KNOWLEDGE

•       SIEM: Microsoft Sentinel(KQL), Splunk (SPL), IBM QRadar, or Elastic — advanced rule writing, not just usage

•       EDR/XDR: TrendAI, CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne — deep investigative and hunting use

•       SOAR: Playbook development in Splunk SOAR, Sentinel Logic Apps, Palo Alto XSOAR, or equivalent

•       DFIR Tooling: Volatility3, Autopsy/FTK, Velociraptor, KAPE, plaso/log2timeline

•       Network Forensics: Wireshark, Zeek, Suricata, NetFlow/IPFIX analysis

•       Malware Analysis: ************* /Cuckoo sandbox, PEStudio, YARA rules, basic static/dynamic analysis

•       Frameworks: MITREATT&CK, NIST IR lifecycle, PICERL

•       OS Forensics: Windows event logs (Security, Sysmon), registry, prefetch; Linux syslog, bash history

•       Active Directory: AD attack paths (Pass-the-Hash, Kerberoasting, DCSync), BloodHound

•       Cloud: AWS CloudTrail, Azure Activity/Sign-In Logs, M365 Unified Audit Log

•       Scripting: Python or PowerShell for enrichment, automation, and IoC ingestion (advantageous)

COMPETENCIES & SOFT SKILLS

•       Attacker mindset — you think like a threat actor to build better detections

•       Calm and decisive under pressure; the team and clients look to you when things are serious

•       Strong written communication — incident reports and executive summaries that are clear and genuinely useful

•       Coaching mindset — you invest in L1/L2 development and take satisfaction in the team improving

•       Commercially aware —understands that SOC performance is a business value driver, not just a technical exercise

•       Adaptable — able to switch between deep forensic work and a client-facing QBR within the same day

EDUCATION & EXPERIENCE

Education

Bachelor's Degree in Cybersecurity, Computer Science, or IT. Diploma holders with strong hands-on experience at senior SOC level are equally considered.

Experience

5–7 years in security operations, with at least 2–3 years at L2/L3 level. Prior team lead, shift lead, or SOC lead experience is strongly preferred. MSSP experience across multiple client environments is a significant advantage.

PREFERRED CERTIFICATIONS

• GIAC GCIH
• GIAC GCIA
• GIAC GCFA
• GIAC GREM
• GIAC GSOC
• CISSP
• CISM
• CompTIA CySA+
• Microsoft SC-200
• Splunk Power User / Admin
• CompTIA SecurityX
• BTL2 / OSCP (Advantageous)