Security Operations Center Analyst

We are seeking a Security Operations Center Analyst in Kuala Lumpur (Hybrid) to support security coverage aligned to Sydney business hours. You will monitor and triage alerts across on-prem and Amazon Web Services (AWS), investigate suspicious activity, escalate confirmed threats and help tune detections and SOAR playbooks. This is a hands-on operations role in a growing team.

Responsibilities

• Monitor SIEM and security tools for attacks, intrusions and suspicious activity across enterprise environments
• Triage alerts, confirm severity, identify false positives and escalate validated threats
• Run security investigations, analyze logs and gather evidence to support incident response
• Use SIEM and SOAR platforms to support monitoring, investigation and response workflows
• Monitor identity and access activity, including suspicious authentication and potential permission misuse
• Support threat hunting, threat intelligence and detection tuning as needed
• Produce investigation summaries and security reports for technical and non-technical stakeholders
• Contribute to day-to-day Security Operations Center coverage and handovers to maintain continuity

Requirements

• Hands-on experience in a Security Operations Center, security monitoring or enterprise security operations environment
• Experience with alert monitoring, triage, investigation, false-positive identification and incident escalation
• SIEM experience with platforms such as Splunk, IBM QRadar, ArcSight, LogRhythm, Elastic Stack (ELK) or Wazuh
• Knowledge of cybersecurity fundamentals including network security, firewalls, intrusion detection and prevention systems (IDS/IPS), common attack techniques and detection methods
• Familiarity with Windows and Linux logs plus network device logging and security event analysis
• Understanding of endpoint security, identity and access monitoring, malware fundamentals and security hardening basics
• Clear documentation skills with the ability to communicate incidents and findings to technical stakeholders
• Shift flexibility to support coverage aligned to Sydney business hours. Shift patterns may change based on operational needs

Nice to have

• Experience with endpoint detection and response platforms such as CrowdStrike Falcon Platform or equivalent
• Exposure to SOAR tools such as Palo Alto Cortex XSOAR and cloud security services such as AWS GuardDuty
• Familiarity with Cloud Security Posture Management tools such as Wiz and email security tools such as Proofpoint

We offer

• By choosing EPAM, you're getting a job at one of the most loved workplaces according to Newsweek 2021 & 2022&2023.

• Employee ideas are the main driver of our business. We have a very supportive environment where your voice matters

• You will be challenged while working side-by-side with the best talent globally. We work with top-notch technologies, constantly seeking new industry trends and best practices

• We offer a transparent career path and an individual roadmap to engineer your future & accelerate your journey

• At EPAM, you can find vast opportunities for self-development: online courses and libraries, mentoring programs, partial grants of certification, and experience exchange with colleagues around the world. You will learn, contribute, and grow with us

Life at EPAM

• EPAM is a leader in the fastest-growing segment (product development/digital platform engineering) of the IT industry. We acquired Just-BI in 2021 to reinforce our leading position as a global Business Intelligence services provider and have been growing rapidly. With a talented multinational team, we provide data and analytics expertise
• We are currently involved in end-to-end BI design and implementation projects in major national and international companies. We are proud of our entrepreneurial start-up culture and are focused on investing in people by creating continuous learning and development opportunities for our employees who deliver engineering excellence for our clients

Hybrid in Malaysia: Kuala Lumpur