Responsibilities

• Monitor alerts and dashboards across Trend Micro (e.g. Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools
• Triage alerts, separate true from false positives, and prioritise by severity and business impact
• Investigate suspicious activity using log analysis, KQL queries, and threat intelligence
• Escalate confirmed incidents to L2/L3 or the incident response team with clear evidence
• Carry out initial containment per playbooks, such as isolating endpoints or blocking indicators
• Tune detection rules and alert thresholds to reduce noise

• Monitor and triage DLP alerts for unauthorised transfer, sharing, or exfiltration of sensitive data
• Investigate policy violations, determine whether they are accidental, negligent, or malicious, and escalate as required
• Review and tune DLP policies and rules to reduce false positives
• Coordinate with data owners, HR, and compliance on confirmed data leakage incidents
• Report DLP incident trends and policy effectiveness

• Run and review vulnerability scans using Tenable and similar tools
• Prioritise findings by severity (CVSS), exploitability, and asset criticality
• Raise remediation tickets, track them to closure, and escalate overdue items
• Manage risk acceptance and exception requests with supporting justification
• Produce vulnerability and patch compliance reports for management and audits

• Document incidents and investigations in the ticketing system (e.g. ServiceNow)
• Maintain SOC playbooks, runbooks, and SOPs
• Prepare shift handover notes and regular security reports
• Support audits, compliance checks, and post-incident reviews

Requirements

• Diploma or Bachelor’s degree in Cybersecurity, IT, Computer Science, or a related field (or equivalent experience)
• 2-4 years in a SOC, security operations, or IT security role
• Hands-on experience with a SIEM (Microsoft Sentinel preferred) and endpoint or XDR tools (Trend Micro preferred)
• Experience with vulnerability scanners (Tenable preferred) and patch management processes
• Understanding of DLP concepts and tools, and of the incident response lifecycle and MITRE ATT&CK
• Preferred certifications: CompTIA Security+, Microsoft SC-200, or Trend Micro certifications
• Nice to have: CEH, GCIH, GCIA, Tenable certifications, or Azure/AWS security certifications

• Strong knowledge of network, endpoint, cloud, and OS security (Windows, Linux)
• Ability to write and read KQL queries and analyse logs
• Familiarity with firewalls, IDS/IPS, WAF, EDR/XDR, DLP, and vulnerability scanners
• Understanding of CVSS scoring, CVE tracking, and risk-based remediation prioritisation
• Strong analytical thinking, attention to detail, and clear written and verbal communication
• Ability to work with infrastructure and application teams to drive remediation
• Calm and effective under pressure and in shift work