Security Analyst – L1( Information Security / Security Operations Center (SOC))

Position: Security Analyst – Level 1

Location: Singapore (Onsite)

Contract Duration: 12 Months (Renewable)

Department: Information Security / Security Operations Center (SOC)

Experience Required: 1–3 Years

Role Overview

We are on the lookout for a diligent and detail-focused Security Analyst – Level 1 to deliver round-the-clock first-level security monitoring, alert triage, and incident management across identity, endpoint, email, and cloud security platforms. This role emphasizes early detection of threats, management of incident tickets, investigation of security events, and prompt escalation of verified threats to advanced security teams.

The successful candidate will possess practical experience with Microsoft security technologies, endpoint protection solutions, identity and access management, Azure monitoring tools, and security operations procedures. This position is vital for preserving the organization's security posture through ongoing monitoring, comprehensive documentation, and strict adherence to incident response protocols.

Key Duties

Security Monitoring & Alert Triage

• Monitor security alerts and events across identity, endpoint, email, and cloud security platforms.
• Evaluate and triage security alerts based on established operational protocols and escalation criteria.
• Conduct initial investigations of suspicious activities and security anomalies.
• Escalate verified threats and high-risk incidents to Level 2 Security Engineers for further analysis.

Identity & Access Security Monitoring

• Oversee Microsoft Entra ID sign-in logs and authentication events.
• Investigate suspicious login attempts, account lockouts, and abnormal authentication trends.
• Monitor Multi-Factor Authentication (MFA) failures and spot potential unauthorized access attempts.
• Assess Conditional Access policy failures and document findings.

Email Security Operations

• Monitor Exchange Online Protection alerts for spam, phishing, malware, and email threats.
• Perform initial analysis of suspicious email activities.
• Escalate high-risk email security incidents for advanced investigation.

Endpoint Security Monitoring

• Monitor endpoint security alerts generated by Trend Micro Endpoint Security solutions.
• Review malware detections, suspicious behaviors, and policy violation alerts.
• Ensure effective ticket creation and escalation for critical endpoint incidents.

Privileged Access & Endpoint Privilege Monitoring

• Oversee CyberArk Endpoint Privilege Manager (EPM) and Privileged Access Management (PAM) alerts.
• Review privileged access activities and identify unusual privilege escalation attempts.
• Escalate suspicious privileged account activities to security engineering teams.

Cloud Security Monitoring

• Monitor Azure security dashboards, Azure Monitor, and Log Analytics workspaces.
• Review cloud security alerts and identify potential threats or misconfigurations.
• Assist in tracking security incidents affecting cloud resources and services.

Incident Management & Documentation

• Create, update, and manage security incident tickets within ITSM platforms.
• Ensure accurate incident classification, documentation, and evidence collection.
• Maintain incident timelines, investigation notes, and closure records.
• Adhere to defined SLAs for ticket acknowledgment, updates, and resolution tracking.

Operational Reporting & Compliance

• Maintain daily security monitoring and shift activity reports.
• Participate in shift handovers and ensure effective knowledge transfer.
• Track certificate expiry notifications and communicate upcoming expirations to the Level 2 Security team.
• Maintain audit-ready documentation and incident records.

Essential Skills & Competencies

Identity & Access Management

• Microsoft Entra ID (Azure AD) administration and monitoring.
• Active Directory authentication monitoring.
• Microsoft Multi-Factor Authentication (MFA).
• Conditional Access monitoring and troubleshooting.

Email Security

• Exchange Online Protection (EOP).
• Spam, phishing, and malware alert analysis.

Endpoint & Privileged Access Security

• Trend Micro Endpoint Security and Email Security.
• CyberArk Endpoint Privilege Manager (EPM).
• CyberArk Privileged Access Management (PAM).

Cloud Security & Monitoring

• Azure Monitor.
• Azure Log Analytics.
• Microsoft Defender (Monitoring and Alert Review).
• Azure security dashboards and monitoring tools.

Security Operations

• Security event monitoring and alert triage.
• Incident handling and escalation procedures.
• Security ticket management and documentation.
• Basic threat detection and analysis techniques.

PKI & Certificate Management

• Basic understanding of Public Key Infrastructure (PKI).
• Certificate lifecycle monitoring and expiry tracking.

IT Service Management

• Experience with ITSM and ticketing platforms.
• Incident tracking, escalation, and SLA management.

Preferred Qualifications

• Certifications in Microsoft Security, Azure, or Security Operations.
• Basic understanding of SIEM concepts and security monitoring workflows.
• Familiarity with security frameworks such as ISO 27001, NIST, or CIS Controls.
• Knowledge of phishing analysis, malware indicators, and identity-based attacks.
• Experience within a Security Operations Center (SOC) environment.

Key Performance Indicators (KPIs)

• Timely triage and response to security alerts within defined SLA.
• Accuracy in incident classification and escalation.
• Prompt creation and maintenance of security tickets.
• Quality of incident documentation and closure notes.
• Completeness of shift handovers and accuracy of operational reporting.
• Compliance with security monitoring procedures and escalation standards.

Success Indicators

• Timely identification and escalation of security threats.
• Consistent monitoring coverage across all security platforms.
• Accurate incident documentation and reporting.
• High adherence to SLAs for security event handling.
• Effective collaboration with Level 2 Security Engineers and Infrastructure Teams.
• Continuous improvement in threat detection and operational efficiency.

Interested applicants can reach out via WhatsApp at +6586533349.