Back to SearchSecurity Operations Center Analyst
Hybrid in Malaysia: Kuala Lumpur
Security.Engineering
Looking for something else?
Find a vacancy that works for you. Send us your CV to receive a personalized offer.
Find me a job
We are seeking a Security Operations Center Analyst in Kuala Lumpur (Hybrid) to support security coverage aligned to Sydney business hours. You will monitor and triage alerts across on-prem and Amazon Web Services (AWS), investigate suspicious activity, escalate confirmed threats and help tune detections and SOAR playbooks. This is a hands-on operations role in a growing team.
Responsibilities
- Monitor SIEM and security tools for attacks, intrusions and suspicious activity across enterprise environments
- Triage alerts, confirm severity, identify false positives and escalate validated threats
- Run security investigations, analyze logs and gather evidence to support incident response
- Use SIEM and SOAR platforms to support monitoring, investigation and response workflows
- Monitor identity and access activity, including suspicious authentication and potential permission misuse
- Support threat hunting, threat intelligence and detection tuning as needed
- Produce investigation summaries and security reports for technical and non-technical stakeholders
- Contribute to day-to-day Security Operations Center coverage and handovers to maintain continuity
Requirements
- Hands-on experience in a Security Operations Center, security monitoring or enterprise security operations environment
- Experience with alert monitoring, triage, investigation, false-positive identification and incident escalation
- SIEM experience with platforms such as Splunk, IBM QRadar, ArcSight, LogRhythm, Elastic Stack (ELK) or Wazuh
- Knowledge of cybersecurity fundamentals including network security, firewalls, intrusion detection and prevention systems (IDS/IPS), common attack techniques and detection methods
- Familiarity with Windows and Linux logs plus network device logging and security event analysis
- Understanding of endpoint security, identity and access monitoring, malware fundamentals and security hardening basics
- Clear documentation skills with the ability to communicate incidents and findings to technical stakeholders
- Shift flexibility to support coverage aligned to Sydney business hours. Shift patterns may change based on operational needs
Nice to have
- Experience with endpoint detection and response platforms such as CrowdStrike Falcon Platform or equivalent
- Exposure to SOAR tools such as Palo Alto Cortex XSOAR and cloud security services such as AWS GuardDuty
- Familiarity with Cloud Security Posture Management tools such as Wiz and email security tools such as Proofpoint