Security Operations

• Monitor security alerts and events across SIEM, endpoint, network, email, identity, and cloud security tools
• Perform alert triage, investigation, enrichment, impact assessment, threat hunting, and root-cause analysis according to role level
• Identify false positives, suspicious patterns, indicators of compromise, repeated attack activity, and control gaps
• Escalate suspected or confirmed incidents to incident responders, platform owners, infrastructure teams, and business stakeholders
• Document alerts, investigations, evidence, response actions, closure rationale, lessons learned, and recommendations in ticketing and case management systems
• Administer and maintain security platforms, including access updates, configuration changes, log source onboarding, connector health checks, alert tuning, rule updates, and dashboard maintenance
• Develop and maintain detection use cases, correlation rules, dashboards, playbooks, standard operating procedures, and response runbooks
• Coordinate incident response activities to support timely containment and remediation
• Provide technical guidance, quality review, mentoring, and investigation coaching to L1 and L2 analysts
• Support 24/7 SOC operations through structured shifts, handovers, service-level adherence, and Follow-The-Sun collaboration with global teams
• Maintain awareness of current threats affecting enterprise environments

SOC Analyst, L1 / L2 / L3

• Lead daily SOC operations across monitoring, alert triage, investigation, escalation, incident response coordination, and operational handoff across global time zones
• Own and mature SOC operating procedures, including incident intake, severity classification, escalation paths, response playbooks, major incident communications, and post-incident reviews
• Manage and improve security monitoring across SIEM, SOAR, EDR/XDR, email security, cloud security, identity security, vulnerability signals, network telemetry, and threat intelligence sources
• Build, tune, and continuously improve detection use cases aligned to enterprise risks, MITRE ATT&CK techniques, threat intelligence, audit findings, and business-critical assets
• Partner with security engineering teams to improve log onboarding, data quality, telemetry coverage, alert fidelity, automation, and response integrations
• Lead incident response coordination for endpoint compromise, identity misuse, phishing, malware, data loss indicators, cloud misconfigurations, suspicious network activity, and unauthorized access attempts
• Establish SOC performance metrics and reporting, including alert volumes, false-positive rates, SLA adherence, escalation quality, MTTD, MTTA, MTTC, and incident trends
• Oversee SOC analyst workflows, shift handoffs, case documentation, evidence handling, and quality assurance reviews
• Coordinate with managed security service providers, internal IT teams, and business stakeholders on timely response and remediation ownership
• Support implementation and operationalization of SOAR playbooks, automation workflows, enrichment logic, and incident response runbooks
• Drive continuous improvement through tabletop exercises, incident retrospectives, purple-team findings, threat hunting outputs, and lessons learned
• Maintain alignment with security governance, regulatory, privacy, and audit requirements
• Serve as security operations lead for global SOC coverage and cross-functional collaboration

Security Operations jobs in Malaysia

SOC Analyst, L1 / L2 / L3

Security Operations Center Lead