全职 Security Analyst L3 工作, 薪水, Ensign InfoSecurity 公司招聘中 - Ricebowl

Responsibilities

• Lead and mentor a team of L1/L2 analysts; provide technical guidance and drive professional development within the SOC
• Own containment, process, and business impact decisions during active incidents; guide post-mortems and drive process changes
• Conduct hypothesis-driven proactive threat hunts across client environments
• Author, optimise, and maintain detection rules and automation playbooks across SIEM and SOAR platforms
• Perform forensic triage in the event of security incidents, including evidence preservation and analysis
• Configure policies with foresight across SOC tools and controls, aligned to client policies and compliance requirements
• Drive and own the incident response process where coordination is required with vendors, external CERTs, and internal business stakeholders
• Drive and own the continuous improvement lifecycle including integrations, playbooks, automations, and stakeholder coordination
• Manage detection use cases, dashboards, and reports on SIEM: develop and implement new use cases, validate and maintain existing rules
• Develop new SOAR playbooks; optimise existing playbooks for accuracy and efficiency
• Respond to incidents and critical alerts outside of office hours when required
• Any other tasks as assigned

Requirements

• Degree in Computer Science, Information Security, or a related discipline
• Over 6 years of experience in cybersecurity operations or a Security Operations Centre (SOC) environment, with demonstrated team leadership
• Hands-on experience with SIEM, SOAR, and EDR platforms; solid understanding of network, Windows, and Linux infrastructure
• Proven ability to lead incident response end-to-end, including containment decisions, post-mortems, and remediation tracking
• Experience conducting proactive, hypothesis-driven threat hunts and authoring detection content
• Clear written and verbal communication; able to produce structured incident reports and brief senior stakeholders
• GIAC Certified Incident Handler (GCIH) or equivalent certification required
• At least one of the following certifications, or equivalent: GIAC Certified Intrusion Analyst (GCIA), GIAC Experienced Intrusion Analyst (GX-IA), Certified Threat Intelligence Analyst (E|CTIA)

Preferred Skills / Qualities

• Experience with forensic analysis tools and evidence handling procedures
• Knowledge of cloud infrastructure security (AWS, Azure, or GCP)
• Familiarity with Threat Intelligence Platforms and IOC management workflows
• Experience with next-generation SIEM, NDR, or ITSM/incident management platforms
• Exposure to OT security monitoring or regulatory frameworks such as NIST CSF, ISO 27001, or GDPR
• CCNA, CEH, CrowdStrike (CCFA/CCFR), or other vendor/networking certifications are a plus