Cybersecurity & Compliance Analyst  

Key Responsibilities

SOC Partner Management and Incident Response

• Manage client’s third-party SOC partner relationship: set monitoring requirements, review escalated alerts, challenge the partner's findings where necessary, and ensure SLA compliance.
• Receive and act on escalated security incidents from the SOC partner: direct containment actions, coordinate with affected teams, and produce incident reports for the Head of IT.
• Conduct periodic reviews of the SOC partner's detection coverage and reporting quality; recommend adjustments to monitoring scope and escalation thresholds.

Security Policy Ownership

• Own client’s IT security policy library: review policies at least annually, update them when systems or regulatory obligations change, and obtain sign-off from the Head of IT.
• Conduct ISO 27001 gap assessments against client’s current security controls; track findings, assign remediation owners, and monitor closure.
• Support SaaS and vendor security assessments: review new tools for data handling risks and provide a structured go / no-go recommendation to the Head of IT before onboarding.

Security Awareness and Phishing Programme

• Design, schedule, and deliver client’s annual security awareness training programme for all staff; maintain training records.
• Plan and execute biannual phishing simulation exercises; measure click-through and submission rates, report outcomes, and run follow-up coaching for high-risk users.
• Produce targeted awareness materials for specific risk areas (e.g. ransomware, social engineering, AI tool misuse) as new threats emerge.

Identity Governance and Data Protection Compliance

• Manage Azure RBAC and Privileged Identity Management (PIM): conduct quarterly access reviews, enforce just-in-time admin activation, and remediate over-privileged accounts.
• Configure and maintain Conditional Access policies in Azure Entra ID: MFA enforcement, device compliance requirements, and location-based access controls.
• Manage Microsoft Purview: DLP policies, sensitivity labels, information barriers, and compliance reports relevant to PDPA and UU PDP data handling requirements.
• Support the Head of IT (DPO) with PDPA compliance: maintain the Data Processing Agreement register, assist with DPIAs for new SaaS systems, and support data breach investigation and notification procedures.

Vulnerability Management and Reporting

• Review vulnerability findings surfaced by CrowdStrike Falcon Spotlight across client’s endpoints; prioritise remediation based on risk, and track closure with asset owners.
• Assess client’s current endpoint device estate and produce a recommendation to the Head of IT on Mobile Device Management (MDM) strategy, covering risk exposure, scope of enforcement, and implementation approach for both Singapore and offshore users.
• Produce monthly security posture reports: open vulnerabilities and ageing, incident summary, access review outcomes, and Secure Score trends across Microsoft 365.

Nice to Have

• SC-200 (Microsoft Security Operations Analyst Associate), AZ-500, CISSP, or CISM certification.
• Singapore PDPA compliance experience or equivalent data protection regulatory exposure.
• Experience running phishing simulations with measurable outcomes.
• SaaS or retail environment security assessment experience.

Required Qualifications & Experience

• Bachelor's degree in Cybersecurity, Computer Science, or Information Technology.
• Minimum 4 years of IT security experience with demonstrated responsibility for security policy, compliance, or security operations oversight.
• Hands-on experience managing or liaising with a third-party SOC or MSSP, including reviewing escalations and challenging vendor output.
• Working knowledge of Microsoft Azure and Microsoft 365 security controls (Entra ID, Purview, Defender for Endpoint, Conditional Access).
• Familiarity with ISO 27001 framework: gap assessment, risk register, and control documentation.
• Good English for written incident reports, policy documentation, and regular communication with the Singapore Head of IT.

Technical Proficiency

Core (must be able to operate on day one)

• Azure Entra ID: Conditional Access policies, PIM, Identity Protection, RBAC access reviews.
• Microsoft Purview: DLP policy configuration, sensitivity labels, compliance manager.
• Microsoft Defender for Endpoint: alert triage and endpoint security concepts; familiarity with MDM integration is an advantage.
• Microsoft 365 security posture: Secure Score interpretation, tenant-level security settings.
• Security policy drafting and review: structured policy documents aligned to ISO 27001 or NIST CSF.

Working Knowledge (enough to review and challenge partner output)

• SIEM concepts: understanding alert logic, detection rules, and escalation thresholds sufficient to hold a SOC partner accountable.
• CrowdStrike Falcon Spotlight: vulnerability prioritisation and remediation tracking.
• Endpoint security concepts: EDR, device compliance baselines, patch management.