L2 SOC Analyst (Security Operations Center)

Role Overview
We are seeking an experienced L2 SOC Analyst to serve as a key escalation lead across a diverse, multi-client enterprise portfolio. Moving beyond routine monitoring, you will drive deep-dive digital forensics, advanced incident investigation, and active threat containment. Operating in a high-consequence environment, this role provides an ideal platform to execute proactive threat hunting, optimize detection engineering, and interface directly with enterprise stakeholders during critical security events.

Key Responsibilities

• Advanced Incident Investigation: Validate and investigate high-priority alerts escalated by L1 analysts to determine root cause, scope of compromise, and enterprise business impact.
• Forensics & Deep Analysis: Conduct complex log analysis, endpoint forensics (EDR/XDR), and network traffic inspection to reconstruct sophisticated attack vectors.
• Threat Mapping & Detection Engineering: Correlate security events against the MITRE ATT&CK framework; fine-tune SIEM correlation rules (SPL, KQL) and SOAR playbooks to elevate SOC detection efficacy.
• Incident Response Leadership: Direct containment, eradication, and recovery strategies for major cyber threats, including ransomware, advanced persistent threats (APTs), and business email compromise (BEC).
• Client Engagement & Stakeholder Reporting: Translate complex technical findings into clear, executive-ready Post-Incident Reviews (PIR) and actionable intelligence for client decision-makers.
• SOC Maturity & Mentorship: Provide ongoing technical guidance, refine standard operating procedures (SOPs), and mentor L1 analysts to build team capability.

Qualifications & Requirements

• Education: Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, or a related field.

• Experience: 5–6 years of progressive cybersecurity experience, with a minimum of 3 years as a Level 2 SOC Analyst within a dedicated SOC environment (MSSP or Systems Integrator experience preferred).

• Communication & Languages: Excellent verbal and written communication skills in English and Bahasa Malaysia; professional fluency in Mandarin is a strong advantage for regional client engagements.

• Technical Mastery:

  • Deep knowledge of Windows/Linux internals, Active Directory, and multi-cloud architectures (AWS/Azure).
  • Hands-on expertise in enterprise SIEM/EDR platforms and SIEM query languages (SPL, KQL).
  • Solid grasp of Incident Response frameworks (NIST SP 800-61 r2) and scripting languages (Python, PowerShell).

• Certifications (Preferred): SANS/GIAC (GCIH, GCIA), Microsoft (SC-200), EC-Council (ECIH, CEH), or CompTIA CySA+.

HOW TO APPLY:

Interested applicants, kindly send your resume in MS WORD format to [email protected] or please click on “Apply Now” and provide the below details in your resume.

We regret only shortlisted candidates will be notified.

Important Note: Agensi Pekerjaan Trust Recruit Sdn Bhd is committed to safeguarding your personal data in accordance with the Personal Data Protection Act (PDPA).

Please read our privacy statement on our corporate website www.trustrecruit.com.my

Agensi Pekerjaan Trust Recruit Sdn Bhd

EA Personnel: Eliza

License No. JTKSM 1580