{"id":135140,"url":"https://alion.io/job/ensign-infosecurity-security-analyst-l3","title":"Security Analyst L3","company":{"id":50230,"name":"Ensign InfoSecurity","domain":"ensigninfosecurity.com","url":"https://alion.io/company/ensign-infosecurity","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"C","score":68,"open_postings":53,"ghost_share":0.623,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":9,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Kuala Lumpur, Malaysia"],"countries":["MY"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":13500,"max_usd":32000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":774},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bash","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"Google SecOps","optional":false},{"name":"HIPAA","optional":false},{"name":"IBM QRadar","optional":false},{"name":"ISO 27001","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PCI DSS","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-08-24T00:00:00Z","employer_posted_date":"2026-08-24","last_verified_at":"2026-10-22T00:55:24Z","board_verified":true,"closed_at":null,"days_open":59,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":59},"description":"Ensign is hiring !\nKey Responsibilities:\nLead investigation and incident response activities for high-severity or complex security incidents across multiple clients.\nAct as final escalation point for incidents unresolved by Tier 1 and Tier 2 analysts.\nConduct advanced forensic analysis of logs, network traffic, endpoints, and malware to identify root cause and scope.\nPerform proactive threat hunting based on current threat intelligence, TTPs (MITRE ATT&CK), IOCs, and anomalous behavior.\nDevelop and refine detection logic, SIEM correlation rules, and EDR/NDR signatures to enhance SOC effectiveness.\nSupport incident containment, eradication, and recovery efforts across diverse client environments.\nCollaborate with Threat Intelligence, Engineering, and IR teams to improve tools, data sources, and workflows.\nIdentify gaps in an organization’s measurement metrics, telemetry, and logging capabilities and propose enhancement strategies to achieve the intended outcomes.\nProvide technical leadership and mentorship to junior analysts, supporting their skill development and analysis quality.\nConduct post-incident reviews and create root cause analysis (RCA) and after-action reports for clients.\nContribute to playbook creation, tuning, and automation efforts, particularly within SOAR platforms.\nInterface with client security teams, IT teams, and executives to communicate investigation findings, remediation guidance, and strategic improvements.\nEnsure SOC processes align with industry frameworks (e.g., NIST, ISO 27001) and client-specific regulatory requirements (e.g., HIPAA, PCI-DSS).\nLead purple team exercises or internal red vs. blue simulations to test detection coverage and SOC readiness.\nRequirements:\nEducation & Experience:\nBachelor’s degree in Cybersecurity, Computer Science, or related discipline (or equivalent hands-on experience).\n4+ years of experience in a SOC or cybersecurity operations role, including experience with incident response and threat hunting.\nPrior experience in an MSSP or multi-tenant SOC environment is strongly preferred.\nTechnical Skills:\nDeep expertise in security tools: SIEM (e.g., Splunk, MS Sentinel, QRadar, Google SecOps, Devo), EDR (e.g., CrowdStrike, SentinelOne), NDR, SOAR.\nStrong understanding of malware behavior, exploit techniques, persistence mechanisms, and attack chain.\nAdvanced knowledge of operating systems (Windows/Linux), networking, firewalls, and cloud security (e.g., Azure, AWS).\nFamiliarity with threat modeling, ATT&CK framework, cyber kill chain, and detection engineering.\nExperience with scripting and automation (e.g., Python, Bash, PowerShell) to improve SOC efficiency.\nCertifications (preferred):\nGIAC certifications (e.g., GCIH, GCFA, GCIA, GDAT, GNFA)\nOffensive Security (OSCP) or equivalent\nCompTIA CASP+, CySA+\nMicrosoft SC-200, Azure Defender certifications\nKey Competencies:\nStrong investigative and analytical skills with attention to detail.\nAbility to manage multiple critical incidents and prioritize effectively under pressure.\nExcellent verbal and written communication, especially in client-facing contexts.\nLeadership and mentoring abilities to upskill junior staff and strengthen SOC maturity.\nStrategic thinking with a continuous improvement mindset.\nHigh degree of professionalism, discretion, and accountability.\nShift Expectations:\nGenerally operates in a regular business-hour schedule, but must be available for escalation during critical incidents.\nMay participate in on-call rotations or emergency response shifts depending on client SLAs.\nCareer Path:\nProgression into roles such as SOC Team Lead, Incident Response Manager, Threat Intelligence Lead, or Security Architect, based on leadership, innovation, and impact.","description_format":"text","description_chars":3732,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Managed Security"],"lifecycle":[{"event":"open","at":"2026-08-24T00:00:00Z"}],"visa":[],"liveness":{"score":6,"band":"cold","label":"Long shot","p_open":1,"p_active":0.183,"p_room":0.35,"age_days":59,"expected_fill_days":9,"reasons":["conf:5","stale_co","velocity","win:tail"],"computed_at":"2026-10-22T06:10:10Z"},"pay":null,"html_url":"https://alion.io/job/ensign-infosecurity-security-analyst-l3","json_url":"https://alion.io/job/ensign-infosecurity-security-analyst-l3.json","meta":{"generated_at":"2026-10-22T22:56:17Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8361,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":50230},"rest":"https://alion.io/mcp/rest/get_company?id=50230"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fensign-infosecurity-security-analyst-l3"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fensign-infosecurity-security-analyst-l3"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fensign-infosecurity-security-analyst-l3"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ensign-infosecurity-security-analyst-l3\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fensign-infosecurity-security-analyst-l3"}]}