Security Operations Centre (SOC) Analyst

Background

CNAV is seeking a technically capable, relatively experienced and self-directed SOC analyst to strengthen its managed security operations. The successful candidate must be comfortable working with limited-bandwidth remote environments, multiple customers, endpoint and network telemetry, and disciplined case management. The role can be a hybrid, based in Singapore or remotely and may require shift, on-call or out-of-hours support according to operational arrangements.

The ideal candidate is an SOC Analyst with hands-on experience who is eager to advance their technical expertise beyond traditional L1/L2 analysis, develop L3-level threat investigation and hunting capabilities, and gain practical experience collaborating with AI-augmented security analysts in a next-generation SOC environment.

Role

The role is responsible for investigating security events escalated through our SOC Platform, validating threats, determining scope and impact, and coordinating timely incident response for managed SOC customers. The role combines hands-on technical investigation, threat hunting, detection improvement and clear customer communication. The analyst will work alongside the rest of the analysts and, as the capability matures, an AI-augmented L3 investigation function; human analysts retain responsibility for evidence validation, decisions and approved response actions.

Company Profile

Founded in 2008, CNAV Business Value Private Ltd. is a Singapore-based cybersecurity solutions and services provider with experience supporting enterprises across South-East Asia. CNAV delivers cybersecurity consulting, implementation and managed security services. Our expanded SOC service combines security monitoring, threat investigation and incident response across enterprise, remote and maritime environments.

Duties

The expected duties of this role are as follows:

1) Security investigation and incident response

• Own and investigate alerts escalations; correlate SIEM, EDR, IDS, firewall, identity, cloud and network evidence to distinguish true positives from benign activity.

• Establish incident chronology, affected assets, attack path, severity, business impact and confidence; investigate malware, phishing, credential misuse, lateral movement, persistence, ransomware and suspected data exfiltration.

• Maintain accurate SOC cases with supporting evidence, analytical reasoning, timelines, decisions, containment recommendations and customer communications; meet agreed escalation and response SLAs.

• Coordinate containment, eradication and recovery with authorised customer personnel; execute remote collection or response only within approved permissions, change controls and audit trails.

• Escalate advanced forensics, high-impact incidents or unresolved technical questions toL3/incident-response specialists; ensure clean handover and follow-through.

2) Threat hunting, intelligence and detection improvement

• Conduct hypothesis-led threat hunts using MITRE ATT&CK techniques, current threat intelligence, IOCs and adversary TTPs; document findings and detection gaps.

• Tune SIEM correlation rules, decoders, alert thresholds and investigation playbooks to improve signal quality and reduce repeat false positives.

• Analyse security alerts, packet captures, NetFlow summaries and endpoint artefacts where available; identify suspicious communications and lateral movement.

• Validate new detection use cases with representative test data; contribute to dashboards, SOC metrics, knowledge base and continuous improvement.

3) Managed SOC delivery and team collaboration

• Coach junior analysts on triage, evidence collection, escalation criteria and case quality; provide structured feedback and training.

• Monitor customers' telemetry health, coverage gaps and log-ingestion failures; coordinate remediation with platform engineering without assuming every alert is a security incident.

• Investigate incidents remotely using locally retained logs and selectively retrieved evidence, recognising bandwidth, latency, connectivity and data-handling constraints.

• Prepare concise technical incident reports, management summaries and shift handovers; explain risk, recommended actions and residual uncertainty to customers.

• Work with emerging AI-assisted L3 workflows: assess AI-generated hypotheses, queries, case summaries and recommendations against source evidence; report hallucinations or unsafe proposals and require human approval for impactful actions.