To support PDAP Security Operations in detecting, investigating, and coordinating the resolution of cybersecurity risks while driving accountability, closure, continuous improvement, and AIOps adoption across the region.
Job Responsibilities:
Security Monitoring & Incident Operations
- Monitor and analyse alerts and cases from SOC, SIEM, EDR, identity-threat detection, endpoint security, IDS/IPS, WAF, email security and other integrated security technologies.
- Validate alerts, collect evidence, assess severity and business impact, and coordinate containment, recovery and follow-up with the SOC provider and relevant teams.
- Support major-incident coordination, including war-room activities, stakeholder updates, investigation records, root-cause analysis and lessons learned.
Accountability, Remediation Tracking & Closure
- Assign or confirm accountable owners, target dates and escalation paths for actionable incidents, vulnerabilities and security findings.
- Track remediation to evidence-based validation and closure; escalate overdue, blocked or high-risk items and maintain a complete audit trail.
- Confirm residual risk and ensure findings are not closed without sufficient evidence or the appropriate risk decision.
Vulnerability & External Attack Surface Management
- Coordinate vulnerability notices, assessment findings, penetration-test findings and urgent remediation follow-up across infrastructure, cloud, application and local IT teams.
- Support EASM operations, validate external exposures and unregistered assets, engage asset owners and track corrective actions to closure.
- Produce vulnerability and exposure trends, ageing views, recurring-risk themes and management reporting.
SOC, SIEM/SOAR & AIOps Improvement
- Work with the SOC provider to improve detection use cases, alert quality, enrichment, correlation, ticket routing and response playbooks.
- Identify and implement automation opportunities for repetitive triage, evidence collection, notification, assignment, remediation tracking, validation and reporting.
- Measure automation outcomes such as workload reduction, response improvement, false-positive reduction and closure performance.
- Apply human oversight, authorization, auditability and rollback controls to AI-assisted or automated actions.
Regional Centre of Excellence & Governance
- Maintain SOPs, runbooks, RACI matrices, escalation procedures, contact lists, control evidence and reusable templates for consistent regional operations.
- Provide operational guidance, coaching and knowledge sharing to regional stakeholders and operating companies.
- Participate in security architecture and service reviews by providing operational risk, monitoring, response and supportability input; final approvals remain with the accountable governance authority.
Reporting, Stakeholder & Vendor Management
- Prepare weekly, monthly and ad-hoc dashboards covering incidents, vulnerabilities, SLA/KPI performance, ageing, closure and improvement actions.
- Coordinate with SOC/MDR providers, security-tool vendors, infrastructure, cloud, application, Service Desk, local IT and management stakeholders.
- Monitor vendor service performance, challenge gaps and ensure agreed actions are tracked to completion.
Main activities & projects
- Daily: SOC/SIEM/EDR/WAF/identity and security-tool alerts, tickets, escalations and remediation follow-up.
- Weekly: High-risk incidents and vulnerabilities, overdue actions, vendor performance and operational coordination.
- Monthly: Security dashboards, SLA/KPI and trend reporting, EASM engagement, vulnerability posture, improvement backlog and management updates.
- Periodic / project-based: SOP standardization, SOC transformation, SIEM/SOAR onboarding, automation use cases, CyberArk/PAM, phishing operations, WAF and other security initiatives.
Job Requirements:
- Bachelor’s degree in computer science, Information Technology, Cybersecurity or a related field; equivalent relevant experience may be considered.
- Approximately 3–5 years of relevant experience in security operations, SOC, incident response, vulnerability management or infrastructure security.
- Practical experience with SIEM and security monitoring technologies. Microsoft Sentinel exposure is preferred; experience with equivalent platforms is relevant.
- Familiarity with technologies such as Microsoft Defender, EDR, WAF, IDS/IPS, IAM/PAM, CyberArk, DLP/CASB, vulnerability-management and EASM solutions.
- Understanding of common cyberattack techniques, alert triage, incident investigation, containment, recovery coordination and evidence handling.
- Ability to manage multiple cases, owners, due dates and escalations and to drive issues through verified closure.
- Working knowledge of automation or orchestration concepts, APIs, scripting, SOAR workflows or AI-assisted security operations is advantageous.
- Strong written and verbal communication skills for technical and non-technical stakeholders across APAC.
- Ability to work independently, collaborate across teams and participate in after-hours incident support when required by the approved operating model.