I51 - Security Analyst (116)
Cyber Security Analyst on a managed SOC team for a financial institution (Income) in Singapore: continuously monitors, triages and closes SIEM alerts, supports incident investigation and response, improves detection use cases, and does forensics/malware analysis. Core tech: enterprise SIEM (e.g., Google SecOps), network/endpoint security tooling.
- Compensation
- Not disclosed
- Location
- Singapore
- Work setup
- Not specified
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 4+ years
- Category
- Security
- Posted
Skills
Must have
- At least 4 years of hands-on information-security experience in a SOC analyst, incident-response analyst, incident-handler or comparable role
- Hands-on experience with enterprise SIEM platforms (e.g., Google Security Operations SIEM) plus understanding of cyber kill chain, TTPs, threat intelligence and malware triage
- Ability to analyse large datasets and packet-level data; operate NIDS/NIPS, firewalls, HIPS, proxies, anti-malware tools and vulnerability scanners and interpret their events
- Strong understanding of common attacks targeting systems, networks and applications
- Strong knowledge of internet infrastructure and network security: DNS, DHCP, firewalls, WAF, IDS/IPS, VPN, APTs, TCP/IP
- Strong analytical and problem-solving skills with a self-motivated, detail-oriented, collaborative approach
- Willingness to learn and contribute in a collaborative team environment
- Ability to remain composed, prioritise and work under pressure during incident investigation and response
- Good interpersonal, written and verbal communication skills
Nice to have
- Experience in a financial-institution SOC environment and incident management
- Industry certifications such as CSA, CISSP, CEH, GCIA, GCIH or equivalent
- Malware triage and analysis capability
Full description
Description
The Cyber Security Analyst is responsible for continuously monitoring, analysing, triaging and resolving cybersecurity events and alerts generated by Income's SIEM System and other security platforms in a managed SOC environment. The role also strengthens threat detection capabilities by identifying detection gaps, enhancing use cases and improving security monitoring processes. Where an event is confirmed as a security incident, the analyst will work with relevant stakeholders and the Security Operations Manager to investigate, contain, remediate and recover from the incident.
This role sits within the IT Risk and Security Department and reports to the Security Operations Manager.
Key Responsibilities
- Continuously monitor, analyse, triage and close security events, alerts and requests received from the managed SOC, security systems and users.
- Support the Incident Manager and relevant stakeholders in investigating, containing, remediating and recovering from security incidents to minimise business impact.
- Enhance SOC detection and response playbooks, develop new incident-response procedures, and maintain clear processes for escalation, communication, evidence collection and documentation.
- Use analytical and data-visualisation tools to automate analysis, derive insights from large datasets, correlate information across SIEM and other data sources, and investigate anomalous activity against established baselines to determine root cause.
- Apply AI-driven and machine-learning capabilities, where appropriate, to support real-time security investigations, threat triage, containment and remediation, escalating issues when required.
- Apply ethical-hacking knowledge to identify potential threats and vulnerabilities and recommend appropriate remediation measures.
- Perform digital-forensics analysis of security events and alerts while following established evidence-handling and chain-of-custody practices.
- Apply reverse-engineering techniques, where required, to understand software behaviour and support malware analysis.
- Develop security-monitoring reports, metrics and dashboards for asset owners and management.
- Stay current with emerging cyber threats, vulnerabilities, attack techniques and industry developments, and translate relevant intelligence into detection and response improvements.
- Participate in cybersecurity exercises, including cyber-range simulations and business continuity exercises.
- Support cybersecurity projects and perform other duties assigned by the Security Operations Manager.
- Coordinate the renewal and maintenance of cybersecurity tools, including tracking licences, support arrangements and vendor deliverables.
Qualifications
- At least 4 years of hands-on information-security experience in a SOC analyst, incident-response analyst, incident-handler or comparable role. Experience in a financial-institution SOC environment and incident management is preferred.