Cybersecurity Engineer

Role Overview

The Cyber Security Analyst is responsible for protecting the company's hybrid IT environment, including on‑premise infrastructure, Active Directory, cloud platforms, and SaaS services from cyber threats. This role covers threat monitoring, incident response, vulnerability management, identity security, and Active Directory administration, ensuring secure and reliable access across the enterprise, and participation in security improvement projects The Cyber Security Analyst is responsible for protecting the company's hybrid IT environment, including on‑premise infrastructure, Active Directory, cloud platforms, and SaaS services from cyber threats. This role covers threat monitoring, incident response, vulnerability management, identity security, and Active Directory administration, ensuring secure and reliable access across the enterprise, and participation in security improvement projects.

KEY RESPONSIBILITIES

1. Threat Monitoring & Detection

• Monitor security alerts from SIEM, EDR, network security, and cloud security platforms.
• Investigate suspicious activity, correlate events, and escalate incidents when required.
• Conduct proactive threat hunting based on indicators, behaviors, and threat intelligence.

1. Incident Response

• Lead or support cyber incident investigations, including containment and remediation.
• Perform root‑cause analysis and maintain detailed incident documentation.
• Coordinate with infrastructure and application teams during incident recovery.

1. Active Directory & Entra ID Administration

• Perform day‑to‑day administration of on‑prem Active Directory and Entra ID.
• Manage user accounts, groups, GPOs, OU structures, and domain policies.
• Ensure directory services are secure, well‑maintained, and follow best practices.
• Monitor AD's health and service availability.

1. AD & Identity Security

• Implement and review hardening controls for AD and Entra ID (e.g., secure admin tiers, privileged access controls, LSASS protection, auditing configuration).
• Regularly assess identity‑related risks: weak passwords, stale accounts, privileged roles, service accounts, SPN issues, and delegated permissions.
• Support and maintain MFA, Conditional Access, and identity protection policies.
• Work with IT teams to enforce Zero Trust identity principles.

1. Vulnerability Management

• Conduct vulnerability scans across servers, applications, cloud workloads, and endpoints.
• Prioritise vulnerabilities based on severity and exploitability.
• Track remediation with system owners and provide reporting to management.

1. Cloud & Hybrid Security

• Monitor Azure, M365, and other cloud environments for misconfigurations or threats.
• Review and enforce baseline configurations using CSPM tools.
• Support identity governance, workload protection, and cloud access security

1. Security Project Management

• Assist in planning, coordinating, and executing new cybersecurity projects
• Work with vendors, internal teams, and stakeholders to track project milestones.
• Prepare project documentation: scope, requirements, testing plans, deployment steps.
• Perform technical validation, testing, and acceptance of new security solutions.
• Ensure security projects are delivered on time, meet requirements, and align with best practices.
• Provide regular project status updates to the IT leadership.

SKILLS AND QUALIFICATIONS

Required Skills

• Strong understanding of security fundamentals and threat vectors.
• Hands‑on experience with Active Directory and/or Entra ID administration.
• Good knowledge of identity security, authentication, MFA, SSO, and access control.
• Familiarity with SIEM, EDR, email security, and cloud security technologies.
• Analytical skills to investigate logs, detect anomalies, and resolve issues.
• Good communication and reporting skills.
• Experience with Microsoft Defender, Intune, Azure Identity Protection.
• Knowledge of regulatory requirements such as BNM RMiT and PDPA.
• PowerShell or Python scripting experience.

Education & Experience

• Degree in Information Security, Computer Science, IT, or related discipline.
• At least 7-10 years experience in cybersecurity, SOC operations, or identity security.

Preferred Certifications

• CISSP, CISM, CRISC
• GIAC certifications (GCIA, GCWN, GSEC, GCIH, GCED)
• Microsoft security certifications (SC‑100, SC‑300, SC‑400, AZ‑500)
• Offensive Security certifications (OSCP, OSWP)
• Other relevant cybersecurity or identity security certifications