SOC Analyst (Tier 2)

More than just a recruitment company. At PRTR, we have been a part of our customer's success for 30 years as their total HR solutions partner. With 550 dedicated professionals and over 15,000 outsourced staff, we will continue to carry out our mission to develop a better career, a better life, and a better society, and thrive to become the No.1 people solutions organization in Southeast Asia.

Role Summary

The SOC Analyst (Tier 2) is responsible for the advanced investigation and analysis of security incidents escalated from Tier 1. The role focuses on in-depth log analysis from firewall and EDR platforms, correlating events across multiple data sources, determining the scope and impact of threats, and providing clear recommendations for containment and remediation.

What You Will Do

• Investigate and analyse security alerts and incidents escalated from Tier 1 analysts.

• Perform in-depth analysis of firewall logs (traffic patterns, allowed and denied connections, and policy hits) and EDR telemetry (process execution, file activity, registry changes and network connections).

• Correlate events across SIEM, firewall, EDR, IDS/IPS and other security tools to reconstruct attack timelines.

• Identify the root cause, scope and potential impact of security incidents.

• Map observed attacker behaviours to the MITRE ATT&CK framework.

• Extract and validate Indicators of Compromise (IOCs).

• Document findings clearly and produce detailed incident reports.

• Recommend and support containment, eradication and recovery actions.

• Provide feedback to improve detection rules and reduce false positives.

• Collaborate with other security teams and share relevant threat intelligence.

• Stay up to date with emerging threats and attack techniques.

What You Will Need

• Experience in a SOC, security operations or cybersecurity analysis role (strong practical knowledge may be considered for candidates with high potential).

• Hands-on experience in analysing firewall and EDR logs.

• Solid understanding of networking fundamentals, Windows and Linux systems, and common attack techniques.

• Familiarity with SIEM platforms and the MITRE ATT&CK framework.

• Ability to work shifts or flexible hours (including weekends and public holidays).

• Good English reading and writing skills for documentation and reporting.

• Relevant certifications, such as CompTIA CySA+, GCIA, GCIH, CEH or equivalent, are a strong advantage.

• Basic scripting skills (Python or PowerShell) for log analysis are a plus.