Cyber Security Operations Center (CSOC) Analyst (English Speaker)

Triage, analyze, and escalate security alerts across SIEM, EDR/XDR, WAF, email security, and cloud log sources, coordinating with the MSSP where relevant.

Own incidents from triage through resolution and follow-up, turning that work into documented playbooks and updated detection logic rather than just closed tickets.

Develop, tune, and validate SIEM detection rules (ES|QL/EQL/KQL or equivalent), including running validation exercises to confirm existing use cases actually fire.

Convert threat intelligence feeds and scheduled hunting queries (e.g., lookalike domain alerts, anomalous auth events) into defined, actionable responses rather than passive detections.

Support the build-out of an insider threat monitoring program, including identity and privileged-access anomaly detection.

Understand the detection tooling and log source pipelines maintained by the MSSP well enough to confirm they're onboarded correctly and functioning, without needing to build or maintain the tooling directly.

Track and report CSOC performance metrics (MTTD/MTTR, false-positive rates, MSSP SLA adherence) to support continuous improvement.

Write and maintain operational documentation, playbooks, and detection rule rationale so knowledge isn't concentrated in one or two people.

Contribute to automating repetitive triage and enrichment work through scripting and workflow tools to reduce manual effort.

Collaborate with internal stakeholders and regional partners, where Chinese language skills may be required.

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field.

3-4 years of experience in a Security Operations Center (SOC) or equivalent security monitoring/detection engineering role.

Hands-on SIEM experience, including detection rule and use case development with a validation mindset (not just rule-writing); query/rule-writing in ES|QL, EQL, KQL, or equivalent; alert triage, enrichment, and case management with ticketing systems; and comfort reading raw logs (auth events, CloudTrail-style audit logs, process trees) without relying solely on pre-built dashboards.

Working knowledge of Python or similar scripting for automation, log parsing, or modifying existing tooling.

Knowledge of common attack techniques, malware behavior, and network security principles, with familiarity mapping detections to MITRE ATT&CK.

Familiarity with incident response frameworks (e.g., NIST, SANS) and experience writing playbooks or documentation from real incidents.

Good understanding of cloud security (AWS, Azure, or GCP) and comfort across Windows, Linux, and macOS.