Cybersecurity analyst

What does a cybersecurity analyst do?

A cybersecurity analyst watches an organisation's systems for signs of attack and acts on what they find.

The work centres on security logs, alerts and incident reports. The closest official role is the security operations analyst.

Most analysts sit in a security operations centre (SOC) or an IT security team. Banks, government agencies, telcos, hospitals and managed security providers all hire for this work. Many Singapore firms outsource part of it.

You work with network engineers, cloud and infrastructure teams, IT support, risk and compliance staff, and business owners. They need to know what an incident means for their systems and customers.

What the work involves

• Review alerts and security logs in a SIEM tool such as Splunk, and flag suspicious or malicious activity.
• Check that log sources still feed the monitoring system, and fix gaps when feeds stop.
• Write and tune detection and alerting rules so alerts are accurate and false alarms drop.
• Investigate user incident reports and judge the type and seriousness of each event.
• Write incident reports and suggest fixes for problems that keep recurring.
• Run scheduled security checks, reviews and control tests, and record the results.

Pay in Singapore

Back to top

Skills a cybersecurity analyst needs

Back to top

Cybersecurity analyst job description

We are hiring a cybersecurity analyst to join our security operations team in Singapore.

You will monitor systems, investigate alerts and respond to incidents. You will also keep log sources and detection rules in good order and report on repeat risks. The role suits someone with an IT or networking background.

Responsibilities

• Monitor security logs and alerts from firewalls, endpoints, servers, cloud services and identity systems.
• Analyse security event data to find suspicious and malicious activity.
• Triage incidents, rate their severity and escalate them using agreed procedures.
• Maintain the log sources that feed the SIEM and report any gaps.
• Develop and tune detection rules and alerts.
• Write the final incident report, covering what happened, the cause and the actions taken.
• Help draft and improve procedures for handling detected incidents.
• Support vulnerability scans and follow up on fixes with system owners.
• Use threat intelligence to check whether new threats affect the organisation.
• Carry out scheduled audits, reviews and control tests, and recommend process improvements.

Requirements

• Diploma or degree in information technology, computer science, cybersecurity or a related field, or equivalent hands-on experience.
• Entry-level roles often ask for 0 to 2 years in IT, networking or a SOC; mid-level roles ask for more.
• Working knowledge of TCP/IP, DNS, firewalls and common attack methods.
• Hands-on use of a SIEM such as Splunk, plus comfort with the Linux command line.
• Certifications such as CompTIA Security+ are often preferred; CISSP or OSCP suit more senior or specialist roles.
• Willingness to work shifts or be on call, as many SOCs run around the clock.

Back to top

Cybersecurity analyst career path

Most analysts start in a SOC, then move into senior investigation, team lead or specialist roles.

The official framework lists the security operations analyst as the entry point.

1. Security operations analyst

   Entry · SkillsFuture title

   Monitor logs and alerts, handle first-line triage, and write incident reports under guidance.

2. Senior security analyst

   Mid

   Lead investigations of complex incidents, tune detection rules and hunt for threats beyond automated alerts.

3. SOC team lead

   Senior

   Run shifts, set triage and escalation practice, coach junior analysts and report to management.

4. Information security manager

   Lead

   Own the security programme, risk reporting, compliance and the budget for people and tools.

Steps marked "SkillsFuture title" follow the career pathway in the SkillsFuture Skills Framework. The others are titles commonly used in Singapore.

Related jobs and their pay

Back to top

Cybersecurity analyst interview questions

We wrote these questions from the skills this job needs. They are not an official question bank.

1. An alert shows many failed logins followed by a successful login from a new country. How do you triage it?

   What a good answer covers

   • Confirms the account, source IP and time, and checks whether the user is travelling or on a VPN
   • Looks at what the account did after the login, such as mailbox rules or file access
   • Checks other logs for the same IP across the organisation
   • Contains the risk by forcing a password reset and ending sessions if the login looks malicious
   • Records findings and escalates by the agreed procedure

2. How would you write a Splunk search to find accounts with many failed logins in a short period?

   What a good answer covers

   • Filters to the right index and source type and to failed-login events
   • Groups events into time windows and counts them by user and source IP
   • Sets a threshold and excludes known service accounts or scanners
   • Sorts results so the highest counts appear first
   • Turns the search into a scheduled alert and reviews false positives

3. A user opens a website. Walk through what happens on the network, and say where you could see it in logs.

   What a good answer covers

   • Describes the DNS lookup, the TCP handshake, TLS negotiation and the HTTP request
   • Names the logs that show each step, such as DNS, proxy, firewall and flow logs
   • Explains how odd DNS patterns or unusual destinations can point to malware
   • Notes the limits of logs when traffic is encrypted

4. A scan returns thousands of findings. How do you decide what to fix first?

   What a good answer covers

   • Combines severity scores with whether the flaw is being exploited in the wild
   • Considers how exposed the asset is, such as internet-facing or internal
   • Weighs the business value of the system and the data on it
   • Agrees fix timelines with system owners and tracks exceptions
   • Rescans to confirm the fix worked

5. You suspect a Linux server is compromised. What do you check first?

   What a good answer covers

   • Reviews logged-in users, recent logins and authentication logs
   • Lists running processes and open network connections
   • Looks for new accounts, SSH keys and scheduled jobs
   • Checks recently changed files and unexpected binaries
   • Preserves evidence and holds off rebooting until a copy is taken

6. Explain the difference between authentication and authorisation. How do multi-factor authentication and least privilege cut risk?

   What a good answer covers

   • Defines authentication as proving identity and authorisation as deciding what that identity can do
   • Explains that a second factor limits damage from stolen passwords
   • Explains that least privilege limits what a compromised account can reach
   • Mentions reviewing access when staff change roles or leave

7. How do you turn threat intelligence into something your SOC can use?

   What a good answer covers

   • Separates indicators such as IP addresses and file hashes from attacker behaviours
   • Judges the source and age of the intelligence before acting on it
   • Maps behaviours to detection rules, for example using the MITRE ATT&CK framework
   • Searches past logs for matches and sets alerts for new ones
   • Retires stale indicators to keep alert volume under control

1. A finance colleague reports a suspicious email and admits clicking the link. What do you do?

   What a good answer covers

   • Asks calm questions: what they clicked, whether they typed a password and when
   • Checks proxy, DNS and email logs for the link and for other recipients
   • Resets the password and ends active sessions if credentials may be exposed
   • Blocks the link or sender and removes the email from other mailboxes
   • Documents the case and suggests awareness follow-up while keeping the tone supportive

2. Your SIEM sends hundreds of alerts a day and most are false positives. Your manager wants the volume down. What do you do?

   What a good answer covers

   • Ranks rules by volume and by how often they lead to real incidents
   • Tunes thresholds, adds sensible exclusions and fixes noisy log sources
   • Tests every change against past true positives so real attacks stay visible
   • Gets sign-off for changes and records the reasoning
   • Tracks the false-positive rate after the changes

3. You are on call at night and files on a shared server are being renamed and encrypted. What are your first steps?

   What a good answer covers

   • Confirms the activity and identifies the affected host and account
   • Isolates the host from the network and leaves it powered on
   • Escalates through the incident process and informs the incident manager
   • Preserves logs and memory evidence for later analysis
   • Keeps a timeline of actions and shares clear updates with stakeholders

1. Tell us about a time you explained a security risk to someone without a technical background.

   What a good answer covers

   • Describes a specific situation and the audience
   • Uses plain language and links the risk to business impact
   • Gives a clear recommendation and a next step
   • Shows how they checked the person understood

2. Describe a time you missed something or reached the wrong conclusion in an investigation. What changed afterwards?

   What a good answer covers

   • Owns the mistake and takes responsibility
   • Explains how it was found and how fast they raised it
   • Describes the fix to the process, rule or checklist
   • Shows what they do differently now

1. You work for a bank. How do the Monetary Authority of Singapore (MAS) Technology Risk Management guidelines affect your daily security work?

   What a good answer covers

   • Says the MAS guidelines set expectations for technology risk, access control, logging and incident management
   • Links them to practical duties such as keeping logs, reviewing access and following incident procedures
   • Knows that serious incidents must be reported to MAS within the time MAS sets, through the firm's own reporting process
   • Says they would check the current text and the firm's own policies instead of relying on memory

2. An incident exposes customer personal data. What does the Personal Data Protection Act (PDPA) mean for how you handle it, and what is your role?

   What a good answer covers

   • Says the PDPA covers the protection of personal data and includes duties around data breaches
   • Explains that the organisation must assess whether the breach is notifiable and act within the legal timeframe
   • Passes facts and evidence to the data protection officer and legal team instead of deciding alone
   • Preserves logs, records what data and how many people were affected, and helps contain the breach
   • Shares details only through the agreed channels

Common questions about a cybersecurity analyst job

Sources