SOC Analyst

This is a fully remote position, open to applicants in Vietnam.

📋 Description

• Oversee, assess, and analyze security alerts and events from SIEM, EDR, SSE, and WAF platforms.

• Conduct thorough investigations of security incidents, encompassing triage, analysis, containment, eradication, and documentation post-incident.

• Collaborate with relevant teams throughout the incident investigation process.

• Evaluate the scope, severity, and impact of security events.

• Distinguish true positives from false positives and escalate confirmed incidents appropriately.

• Implement response actions such as isolating endpoints, blocking indicators, disabling compromised accounts, and enforcing access restrictions.

• Conduct structured shift handovers across regions following the follow-the-sun model.

• Perform threat hunting across endpoint, network, and log data, aligning findings with MITRE ATT&CK.

• Provide insights on detection quality and refine SIEM correlation rules, EDR custom detections, and WAF rules.

• Enhance investigations with threat intelligence, indicators of compromise, attacker techniques, and emerging campaigns.

• Create and maintain technical documentation, standard operating procedures, and incident response playbooks.

• Work in partnership with IT, infrastructure, application, and security engineering teams.

• Assist in vulnerability management and the ongoing enhancement of the organization's security posture.

• Report to the SOC Lead.

⛳️ Requirements

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field (or equivalent practical experience).

• Minimum of 3 years of hands-on experience as a SOC Analyst, managing alerts and investigating security incidents in a production environment.

• Strong working knowledge of EDR, SSE, SIEM, and WAF technologies.

• Practical experience in implementing, configuring, and tuning security platforms, or in writing and refining detection content, is highly advantageous.

• Background in incident response and threat hunting.

• Familiarity with the MITRE ATT&CK framework is preferred.

• Comprehensive understanding of network security, endpoint security, cloud security, and Zero Trust principles.

• Relevant certifications such as Security+, CySA+, GCIA, GCIH, BTL1, or vendor-specific credentials are beneficial.

• Strong analytical, troubleshooting, and problem-solving abilities with meticulous attention to detail.

• Capability to handle sensitive information with responsibility and security.

• Proficient written and verbal communication skills in English.

• Ability to work effectively with both technical and non-technical teams across various time zones.

• Comfortable working independently in a remote, follow-the-sun team environment.

🏝️ Benefits

• Fully remote work.

• Global remote team and follow-the-sun work model.

• Opportunity to collaborate with global fintech and digital finance experts.

• Professional development through hands-on engagement with security platforms, threat hunting, and incident response.

• Flexible remote work environment.

• Global collaboration across time zones.