{"id":135139,"url":"https://alion.io/job/ensign-infosecurity-l2-security-analyst","title":"L2 Security Analyst","company":{"id":50230,"name":"Ensign InfoSecurity","domain":"ensigninfosecurity.com","url":"https://alion.io/company/ensign-infosecurity","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":73,"open_postings":51,"ghost_share":0.529,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":9,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Kuala Lumpur, Malaysia","Malaysia"],"countries":["MY"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":10000,"max_usd":28000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":528},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"SIEM","optional":false},{"name":"Corelight","optional":true},{"name":"Cortex","optional":true},{"name":"Cortex XSOAR","optional":true},{"name":"Crowdstrike","optional":true},{"name":"Darktrace","optional":true},{"name":"IBM QRadar","optional":true},{"name":"Jira","optional":true},{"name":"Linux","optional":true},{"name":"Microsoft Defender","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"PowerShell","optional":true},{"name":"Prometheus","optional":true},{"name":"Python","optional":true},{"name":"SentinelOne","optional":true},{"name":"ServiceNow","optional":true},{"name":"SLI/SLO/SLA","optional":true},{"name":"Splunk","optional":true},{"name":"TheHive","optional":true},{"name":"Windows","optional":true}],"status":"live","first_seen_at":"2026-08-26T00:00:00Z","employer_posted_date":"2026-08-26","last_verified_at":"2026-10-17T21:07:05Z","board_verified":true,"closed_at":null,"days_open":52,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":52},"description":"Ensign is hiring !\nAs a Level 2 Security Analyst in a Managed Security Service Provider (MSSP) environment, you will serve as an advanced escalation point for Tier 1 analysts, handling complex alerts and security incidents across multiple client environments. Your primary responsibility is to investigate threats in-depth, guide incident response efforts, enhance detection capabilities, and ensure clients are protected with timely and accurate responses. This role demands strong technical, analytical, and communication skills to succeed in a fast-paced, multi-tenant SOC.\nKey Responsibilities:\nAnalyze and respond to escalated alerts from Tier 1 analysts across multiple clients.\nConduct in-depth investigations using SIEM, EDR, NDR, firewall logs, and other security tools.\nPerform malware analysis, log correlation, and network traffic analysis to identify attack vectors.\nExecute containment, eradication, and recovery procedures using predefined runbooks and playbooks.\nEscalate and coordinate with Level 3 analysts or incident response teams for high-severity incidents.\nProvide technical guidance, support, and mentoring to Tier 1 analysts.\nIdentify gaps in detection capabilities and recommend improvements in correlation rules, tuning, and alerts.\nSupport proactive threat hunting initiatives based on IOCs, TTPs, and contextual threat intelligence.\nMonitor external threat intelligence feeds and correlate them with client telemetry to identify potential risks.\nMaintain clear and accurate documentation of all investigations, actions taken, and incident outcomes.\nContribute to the continuous improvement of SOC processes, including the development of SOPs, playbooks, and runbooks.\nEnsure all activities are performed in compliance with client-specific SLAs, internal policies, and applicable regulatory standards.\nParticipate in client-specific onboarding activities and ensure monitoring tools are correctly configured.\nJoin incident review meetings and provide root cause analysis and post-incident reporting when required.\nHandle shift handovers with detailed summaries and ensure continuity of investigations and tasks.\nParticipate in internal knowledge-sharing sessions and contribute to SOC-wide initiatives and improvements.\nRequirements:\nEducation & Experience:\nBachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field-or equivalent work experience.\n2-4 years of experience in a Security Operations Center or similar cybersecurity environment.\nExperience working in an MSSP or multi-tenant environment is highly desirable.\nTechnical Skills:\nStrong experience with SIEM platforms (e.g., Splunk, Sentinel, QRadar).\nHands-on experience with EDR tools (e.g., CrowdStrike, SentinelOne, Microsoft Defender).\nFamiliarity with NDR and SOAR platforms is a plus (e.g., Darktrace, Corelight, Cortex XSOAR).\nStrong understanding of networking protocols, log analysis, and system administration (Windows/Linux).\nKnowledge of malware behaviors, phishing techniques, and MITRE ATT&CK framework.\nExperience with scripting and automation tools (e.g., Python, PowerShell) is a plus.\nFamiliarity with case management tools (e.g., Jira, ServiceNow, TheHive).\nCertifications (preferred):\nCompTIA Security+, CySA+, or equivalent.\nGIAC certifications (e.g., GCIH, GCIA, GCFA).\nCEH, or vendor-specific certifications (e.g., Microsoft SC-200, CrowdStrike CCFR).\nKey Competencies:\nStrong analytical and problem-solving skills.\nExcellent written and verbal communication-especially in client-facing documentation and briefings.\nAbility to handle multiple investigations and prioritize effectively under pressure.\nCustomer-centric mindset with attention to SLA adherence and service quality.\nCollaborative, team-oriented, and proactive with continuous learning attitude.\nShift Expectations:\nParticipation in shift rotations (24/7 support model, if applicable), including weekends and public holidays.\nOn-call support may be required depending on client SLAs and incident severity.","description_format":"text","description_chars":4015,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Managed Security"],"lifecycle":[{"event":"open","at":"2026-08-26T00:00:00Z"}],"visa":[],"liveness":{"score":3,"band":"cold","label":"Long shot","p_open":1,"p_active":0.112,"p_room":0.28,"age_days":52,"expected_fill_days":9,"reasons":["conf:0","stale_co","velocity","win:tail","crowd:junior"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/ensign-infosecurity-l2-security-analyst","json_url":"https://alion.io/job/ensign-infosecurity-l2-security-analyst.json","meta":{"generated_at":"2026-10-17T21:48:26Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6568,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":50230},"rest":"https://alion.io/mcp/rest/get_company?id=50230"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fensign-infosecurity-l2-security-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fensign-infosecurity-l2-security-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fensign-infosecurity-l2-security-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ensign-infosecurity-l2-security-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fensign-infosecurity-l2-security-analyst"}]}