Cyber Security Operations Center (CSOC) Analyst, English Speaker

• Perform triage, analysis, and escalation of security alerts across SIEM, EDR/XDR, WAF, email security, and cloud log sources, coordinating with the MSSP where relevant.
• Own incidents end-to-end from triage through resolution and document what changed afterward.
• Develop, tune, and validate SIEM detection rules using ES|QL, EQL, KQL, or equivalent.
• Convert threat intelligence feeds and scheduled hunting queries into actionable response.
• Support the build-out of an insider threat monitoring program, including identity and privileged-access anomaly detection.
• Verify that detection tooling and log source pipelines are correctly onboarded and working.
• Track and report CSOC performance metrics including MTTD/MTTR, false-positive rates, and MSSP SLA adherence.
• Write and maintain operational documentation, playbooks, and detection rule rationale.
• Contribute to automation of repetitive triage and enrichment work.
• Collaborate with internal stakeholders and regional partners, where Chinese language skills may be required.

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• 3-4 years of experience in a Security Operations Center (SOC) or equivalent security monitoring/detection engineering role.
• Hands-on experience with SIEM tools, including detection rule and use case development, detection validation, ES|QL, EQL, KQL, alert triage, enrichment, case management with ticketing systems, and raw log analysis.
• Working knowledge of Python or similar scripting for automation, log parsing, or extending existing tooling.
• Knowledge of common attack techniques, malware behavior, and network security principles, with familiarity mapping detections to MITRE ATT&CK.
• Familiarity with incident response frameworks such as NIST and SANS, and experience writing playbooks or documentation from real incidents.
• Exposure to identity/IAM log analysis or insider threat / UEBA concepts is a strong plus.
• Good understanding of cloud security across AWS, Azure, or GCP.
• Comfort across Windows, Linux, and macOS.
• Familiarity with Atomic Red Team or an equivalent adversary emulation framework is a nice-to-have.
• Chinese language proficiency is a strong advantage.
• Relevant certifications such as CISSP, GCIH, GCFA, CompTIA Security+, CySA+, or CEH are desirable.

• Competitive total compensation package
• Various team-building programs and company events