Cyber Defence Analyst

About the role

A&O Shearman is hiring Cyber Defence Analysts for its global Information Security team in the Singapore office. This is a hands-on role investigating security alerts, responding to cyber incidents and helping protect an international organisation from evolving threats, within a 24/7 follow-the-sun global team. Weekend working is required, with exact shift patterns discussed at interview.

Key responsibilities

• Investigate and prioritise escalated cyber security events and alerts, and follow established playbooks for data loss incidents raised by employees or third parties.
• Respond to information security queries and work with colleagues across the team.
• Support incident response: triage, investigation, containment, mitigation and remediation, and gather and document forensic evidence.
• Take part in incident response exercises and post-incident reviews, and join the Cyber Defence on-call rota, including out-of-hours support.
• Work with Cyber Defence teams across time zones and apply threat intelligence to investigations.
• Help implement and improve Cyber Defence tools, playbooks and documentation, and identify ways to improve detection and response.
• Collaborate with Information Security, IT and other teams and give stakeholders clear, business-friendly guidance.

Required profile

• 1+ years' experience in Security Operations, Cyber Defence, a SOC or a similar technical security environment.
• Practical experience across at least two areas such as alert triage, incident response, security engineering, detection/rule writing, DFIR, threat intelligence, vulnerability management or security control testing.
• Analytical and investigative mindset, strong communication skills, and the ability to explain technical issues clearly to different audiences.

Required skills

• Working knowledge of SIEM, IDS/IPS, endpoint protection/EDR, firewalls and threat or vulnerability management tooling.
• Strong networking fundamentals, particularly TCP/IP, DNS and SMTP.
• Nice to have: DFIR certification, penetration testing or web application security experience, scripting with Python and/or PowerShell, Azure/AWS/GCP experience, and certifications such as CompTIA Security+, CEH, CISSP or CISM.