{"id":4070979,"url":"https://alion.io/job/deriv-senior-soc-analyst","title":"Senior SOC Analyst","company":{"id":1778315,"name":"Deriv","domain":"deriv.com","url":"https://alion.io/company/deriv","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Zoho Recruit","truth_index":{"grade":"A","score":95,"open_postings":15,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":132,"computed_at":"2026-11-11T05:49:22Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Cyberjaya, Malaysia"],"countries":["MY"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"GCP","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-07-15T00:00:00Z","employer_posted_date":"2026-07-15","last_verified_at":"2026-11-11T13:27:24Z","board_verified":true,"closed_at":null,"days_open":119,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":119},"description":"We're not hiring a security engineer to keep up with threats. We're hiring someone to make threats irrelevant before they become incidents.\nMost security teams react. They tune SIEM rules after the alert fires. They write playbooks after the incident closes. They patch after the scan flags. At Deriv, we're building an autonomous security operations platform that hunts proactively, responds automatically, and learns continuously. Real money, real regulations, real consequences - and a security function built to match.\nWhy This Matters\nDeriv's mission is Trading for Anyone, Anywhere, Anytime. Millions of traders across the globe, around the clock, across regulatory environments. At this scale, a misconfigured WAF rule or undetected lateral movement isn't a technical inconvenience - it's a trader's funds at risk and a regulator on the phone.\nOur Security Operations team isn't defending a perimeter. We're protecting a living, distributed system that processes transactions 24/7. When the threat surface never sleeps, your detection and response capabilities can't either - which is exactly why we're embedding AI and automation at every layer of the security stack.\nThe Challenge\nMost of the job is quiet. Alerts fire, most of them are noise, you clear them and move on. Then one day something doesn't smell right - a login from a place it shouldn't be, a process spawning something it never has before - and the whole shift changes shape in five minutes. That's the job. Long stretches of discipline, then a sprint where the root cause has to be found before the damage does.\n$600B moves through this platform every month. That draws real attention: state-sponsored crews, financially motivated groups, insiders. We don't wait for a vendor's threat intel feed to tell us something's wrong. We hunt for it.\nIf your idea of SOC work is clearing a queue against a runbook, this isn't for you. If you want to build the detections that catch what the runbook doesn't, and you're willing to be the one who says \"this exclusion is a blind spot\" before it becomes an incident, keep reading.\nWhy Deriv\nWe're in production, not planning.\nAutonomous security operations platform triaging real alerts in real time, not a roadmap slide\nAutomated security review running on every pull request across engineering\nDetection coverage actively extending into our AI agent stack: prompt injection, tool misuse, credential exposure in agent workflows, ground most SOCs haven't even started mapping\nA Security & AI Engineering org where detection and response is treated as its own discipline, not a compliance checkbox tucked under IT\nWe share what we learn. Deriv is where we write about what we're building, what breaks, and what we figure out the hard way.\nWhat You’ll Do\nHunt proactively across infrastructure, cloud, identity, and endpoint, working from hypotheses, not just waiting on alerts\nBuild, tune, and maintain detections mapped to real attacker TTPs (MITRE ATT&CK), not whatever ships default from the vendor\nOwn incidents end to end: triage, containment, root cause, and a report that leads to an actual fix\nPush back on any tuning decision, exclusion, or \"known good\" assumption that trades visibility for noise reduction, and catch it before it ships\nPartner with Red Team on purple-team exercises, turning every finding into a detection\nExtend detection and monitoring coverage into our AI agent stack: prompt injection, tool misuse, credential exposure in agent workflows\nDo enough malware analysis and reverse engineering to actually understand what you're looking at, not just what a sandbox report says\nMentor junior analysts and raise the bar on what \"triaged\" actually means\nWho You Are\n6+ years in a SOC, threat hunting, or DFIR role, with real incident ownership, not just alert queue work\nGCFA, GCIH, GCIA, or equivalent DFIR/detection engineering credential strongly preferred\nReal depth in at least three of: EDR internals and endpoint telemetry, cloud security monitoring (AWS/GCP), network forensics, malware analysis, SIEM and detection-as-code, identity threat hunting\nComfortable writing your own detection logic and tooling in Python or a proper query language, not copy-pasting from a vendor blog\nYou think like an attacker when you write a detection, because that's the only way to catch one\nYou know the difference between reducing noise and creating a blind spot, and you've caught that mistake before it cost someone\nYou can write a report that gets fixed, not filed\nThe Honest Reality\nYou'll sit inside a Security & AI Engineering org that treats detection and response as a real discipline, not a compliance checkbox.\nYou'll work across Dubai and Malaysia with a team that runs actual incident response, not tabletop exercises with fake scenarios.\nYou'll have a direct line from catching something to it getting closed for good, and room to build the hunts and detections that shape how we defend the AI agents everyone else is still figuring out how to even think about.","description_format":"text","description_chars":5004,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Online Brokerage & Trading Platforms","Forex & CFD Brokers"],"lifecycle":[{"event":"open","at":"2026-11-11T13:27:24Z"}],"visa":[],"liveness":{"score":48,"band":"ok","label":"Likely open","p_open":1,"p_active":0.797,"p_room":0.6,"age_days":119,"expected_fill_days":132,"reasons":["conf:2","win:late","crowd:"],"computed_at":"2026-11-11T15:29:43Z"},"pay":null,"html_url":"https://alion.io/job/deriv-senior-soc-analyst","json_url":"https://alion.io/job/deriv-senior-soc-analyst.json","meta":{"generated_at":"2026-11-11T15:29:43Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":28940,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1778315},"rest":"https://alion.io/mcp/rest/get_company?id=1778315"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fderiv-senior-soc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fderiv-senior-soc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fderiv-senior-soc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/deriv-senior-soc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fderiv-senior-soc-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4070979}},{"tool":"search_jobs","arguments":{"company":"deriv.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4070979},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}