IT Security Analyst – Information Security Operations

About the role

The IT Security Analyst will support and enhance the organisation's information security across infrastructure, cloud platforms, applications, and end‑user environments. The role focuses on daily security operations, incident handling, and user security awareness while ensuring compliance with internal and external standards.

Key responsibilities

• Monitor and respond to security alerts from endpoint, email, network, and cloud security systems.
• Investigate incidents, determine root causes, and assist with remediation.
• Support vulnerability scanning, tracking, and remediation follow‑up.
• Assist with endpoint and server patch management and compliance monitoring.
• Help implement and maintain IT security policies, standards, and guidelines.
• Participate in security risk assessments for systems, applications, and third‑party vendors.
• Maintain security documentation, risk registers, and audit records.
• Support security controls for Microsoft 365, Azure, and other cloud services.
• Assist with identity and access management, MFA, and conditional access.
• Review configurations related to data protection, logging, and access control.
• Support endpoint protection, device compliance, and security hardening.
• Assist with email security, phishing analysis, and user‑reported incidents.
• Contribute to security awareness training and user education initiatives.
• Participate in IT and security projects, including new system rollouts and vendor engagements.

Required profile

• Bachelor's degree in IT, Computer Science, Cybersecurity or a related field.
• 2‑5 years of experience in IT security, cybersecurity operations, or a related support role.
• Good knowledge of common security threats such as phishing, malware, ransomware, account compromise, and social engineering.
• Strong communication skills in English, Mandarin, and Cantonese.
• Ability to work independently, prioritize tasks, and handle incidents under pressure.

Required skills

• Microsoft 365 security features
• Azure and Entra ID / Azure AD
• Multi‑factor authentication and conditional access
• Cloud security (AWS, Alibaba Cloud)
• Sophos Central EDR
• Check Point and Microsoft Defender email security
• Firewalls and basic log analysis
• Vulnerability scanning and patch management
• Endpoint protection and security hardening
• Phishing analysis and security awareness training
• ISO 27001 compliance knowledge