L2 SOC ANALYST LEAD (GOVERNMENT SECURITY CLEARANCE PREFFERED)

Your tasks

Job Overview We seek an L2 SOC Lead with active threat hunting, incident response, and team leadership experience to manage a 5-8 member SOC team serving government and critical infrastructure sectors. Operating in 24/7 shifts, you will perform advanced triage, conduct forensic investigations, front client engagements, and maintain active cyber community involvement for real-time threat intelligence. This role requires SC clearance and deep expertise in GovTech IM8/CSArequirements.

Threat Operations Leadership

1. Lead daily shift operations with accountability for incident SLA adherence (MTTR< 15 mins for P1 cases).

1. MentorL1 analysts in alert validation, triage techniques, and playbook execution.

1. Conduct purple team exercises quarterly to validate detection capabilities.

Advanced Security Operations

1. Perform deep-dive investigations (memory/disk forensics, malware analysis) using tools:

1. EDR(CrowdStrike/SentinelOne)

1. SIEM(Splunk ES/QRadar with SOAR integration)

1. Networkanalysis (Wireshark, Corelight)

1. Lead proactive threat hunts using MITRE ATT&CK frameworks and threatintelligence.

1. Develop custom detection rules (YARA, Sigma) for APT groups targeting SEA.

Client& Governance

1. Front incident response briefings for customers & stakeholders

1. Present monthly SOC reports to clients (threat trends, gap analysis, KPIs).

1. Ensure compliance with IM8, NIST 800-53, and CSA Cybersecurity Act.

Maintain participation in

1. ASEANCERT communities

1. Threat intel platforms (MISP, ThreatConnect)

1. Industrygroups (ISC2 Singapore, ACSC Partnership Program)

1. Disseminate actionable IOCs to team during shifts.

1. Monthly presentation of SOC reports to client CISOs.

1. Quarterly threat briefings at events (e.g., GovWare, Cyber Security ASEAN).

Requirements

Must-Have Tools Expertise

1. Incident Response - Velociraptor, Autopsy, SIFT Workstation

1. Threat Hunting - Atomic Red Team, Kestrel analytics, ELK stack

1. Forensics- Volatility, Rekall, FTK Imager

1. CTI Management - MISP taxonomies, STIX/TAXII feeds, OpenCTI

Certifications

1. Required: CISSP, GCIH/GCFA, SC Security Clearance

Leadership& Experience

1. 5+years in SOC roles with 2+ years leading teams in 24/7 environments.

1. Proven track record:

1. Managed≥200 critical incidents annually

1. Reduced false positives by ≥40% through detection engineering

1. Led threat hunts uncovering ≥3 advanced persistent threats

1. Government project experience (IM8, CSA Cyber Essentials, or equivalent).

Other

Shift& Engagement Requirements

1. Willingness for 12-hour rotational shifts (including nights/weekends).