Security Operations Analyst – Microsoft Security Focus

About the role

Our client, a leading financial services organisation with a strong presence across Asia, is expanding its cybersecurity capabilities. The Security Operations Analyst will join a lean, Singapore‑based security team and take ownership of day‑to‑day monitoring, investigation and response activities.

Key responsibilities

• Monitor and triage alerts from an external managed SOC, validating and escalating incidents as needed.
• Develop, tune and maintain detections in Microsoft Sentinel using KQL, and create analytical workbooks.
• Investigate incidents across endpoint, identity, cloud and network telemetry, applying the MITRE ATT&CK framework.
• Support incident response, containment and remediation efforts.
• Contribute to vulnerability management, threat intelligence, security awareness and management reporting.
• Assess the performance of the managed SOC and continuously improve detection quality and operational processes.

Required profile

• Minimum 4 years of hands‑on experience in security operations, SOC or incident response, preferably in a regulated financial services environment.
• Strong practical experience with Microsoft Sentinel, including analytics rule development, KQL queries and workbook creation.
• Hands‑on knowledge of Microsoft Defender XDR, Entra ID log analysis and Conditional Access.
• Proven ability to investigate security incidents end‑to‑end and apply MITRE ATT&CK.

Required skills

• Microsoft Sentinel
• KQL (Kusto Query Language)
• Microsoft Defender XDR
• Entra ID / Azure AD
• Azure security tooling
• PowerShell scripting
• Python scripting
• MITRE ATT&CK framework