Cybersecurity & Compliance Analyst

Key Responsibilities SOC Partner Management and Incident Response Manage client’s third-party SOC partner relationship: set monitoring requirements, review escalated alerts, challenge the partner's findings where necessary, and ensure SLA compliance. Receive and act on escalated security incidents from the SOC partner: direct containment actions, coordinate with affected teams, and produce incident reports for the Head of IT. Conduct periodic reviews of the SOC partner's detection coverage and reporting quality; recommend adjustments to monitoring scope and escalation thresholds. Security Policy Ownership Own client’s IT security policy library: review policies at least annually, update them when systems or regulatory obligations change, and obtain sign-off from the Head of IT. Conduct ISO 27001 gap assessments against client’s current security controls; track findings, assign remediation owners, and monitor closure. Support SaaS and vendor security assessments: review new tools for data handling risks and provide a structured go / no-go recommendation to the Head of IT before onboarding. Security Awareness and Phishing Programme Design, schedule, and deliver client’s annual security awareness training programme for all staff; maintain training records. Plan and execute biannual phishing simulation exercises; measure click-through and submission rates, report outcomes, and run follow-up coaching for high-risk users. Produce targeted awareness materials for specific risk areas (e.g. ransomware, social engineering, AI tool misuse) as new threats emerge. Identity Governance and Data Protection Compliance Manage Azure RBAC and Privileged Identity Management (PIM): conduct quarterly access reviews, enforce just-in-time admin activation, and remediate over-privileged accounts. Configure and maintain Conditional Access policies in Azure Entra ID: MFA enforcement, device compliance requirements, and location-based access controls. Manage Microsoft Purview: DLP policies, sensitivity labels, information barriers, and compliance reports relevant to PDPA and UU PDP data handling requirements. Support the Head of IT (DPO) with PDPA compliance: maintain the Data Processing Agreement register, assist with DPIAs for new SaaS systems, and support data breach investigation and notification procedures. Vulnerability Management and Reporting Review vulnerability findings surfaced by CrowdStrike Falcon Spotlight across client’s endpoints; prioritise remediation based on risk, and track closure with asset owners. Assess client’s current endpoint device estate and produce a recommendation to the Head of IT on Mobile Device Management (MDM) strategy, covering risk exposure, scope of enforcement, and implementation approach for both Singapore and offshore users. Produce monthly security posture reports: open vulnerabilities and ageing, incident summary, access review outcomes, and Secure Score trends across Microsoft 365. Nice to Have SC-200 (Microsoft Security Operations Analyst Associate), AZ-500, CISSP, or CISM certification. Singapore PDPA compliance experience or equivalent data protection regulatory exposure. Experience running phishing simulations with measurable outcomes. SaaS or retail environment security assessment experience. Required Qualifications & Experience Bachelor's degree in Cybersecurity, Computer Science, or Information Technology. Minimum 4 years of IT security experience with demonstrated responsibility for security policy, compliance, or security operations oversight. Hands-on experience managing or liaising with a third-party SOC or MSSP, including reviewing escalations and challenging vendor output. Working knowledge of Microsoft Azure and Microsoft 365 security controls (Entra ID, Purview, Defender for Endpoint, Conditional Access). Familiarity with ISO 27001 framework : gap assessment, risk register, and control documentation. Good English for written incident reports, policy documentation, and regular communication with the Singapore Head of IT. Technical Proficiency Core (must be able to operate on day one) Azure Entra ID: Conditional Access policies, PIM, Identity Protection, RBAC access reviews. Microsoft Purview: DLP policy configuration, sensitivity labels, compliance manager. Microsoft Defender for Endpoint: alert triage and endpoint security concepts; familiarity with MDM integration is an advantage. Microsoft 365 security posture: Secure Score interpretation, tenant-level security settings. Security policy drafting and review: structured policy documents aligned to ISO 27001 or NIST CSF. Working Knowledge (enough to review and challenge partner output) SIEM concepts: understanding alert logic, detection rules, and escalation thresholds sufficient to hold a SOC partner accountable. CrowdStrike Falcon Spotlight: vulnerability prioritisation and remediation tracking. Endpoint security concepts: EDR, device compliance baselines, patch management.