IT Security Analyst

Vulnerability & Baseline management:

Conduct regular vulnerability assessments across IT systems, infrastructure, and applications; coordinate with relevant teams to prioritize, track, and remediate identified vulnerabilities.

Establish and maintain system hardening baselines across endpoints, servers, and cloud workloads in alignment with CIS Controls and security standards.

Security operations & Incident handling:

Monitor, correlate, and analyze alerts from centralized logging, Microsoft Defender and related platforms to detect anomalous activity and emerging threats. Triage and validate alerts efficiently, distinguishing actionable security events from false positives.

Investigate cybersecurity incidents, perform root cause analyses, and implement containment/ remediation measures to mitigate business impact.

Manage and monitor email security solutions; investigate and respond to phishing, business email compromise (BEC) and malware.

Audit support, assessment & Reporting:

Assist in gathering and verifying technical evidence, audit logs, and configurations to support internal and external security audits and compliance frameworks (like HIPAA, healthcare data privacy standards, CIS control, …).

Maintain and update technical documentation, standard operating procedures (SOPs), and baseline configuration records.

Evaluate security solutions and conduct PoC testing; assess software security risks before deployment or operational use.

Prepare regular reports on security incidents, vulnerability metrics, emerging security risks, and attack trends for management review and continuous improvement.

Perform other related information security tasks and support projects as assigned by management

Bachelor’s degree in Information Technology, Information Security, Computer Science, or a related field. 1-3 years of hands-on experience in information security, SOC/analyst roles, or IT infrastructure security.

Hands-on experience with security tools such as vulnerability scanners, SIEM, EDR, email security, and Cloud/WAF (familiarity with Nessus, Qualys, Microsoft Defender, Cloudflare, or equivalents).

Preferred qualifications include familiarity with CIS Controls, NIST guidance, ISO 27001, or HIPAA; English proficiency for reading technical documentation and communicating with auditors or vendors; and certifications such as CompTIA CySA+, Security+, CEH, or equivalent.

Solid grounding in core networking concepts (TCP/IP, DNS, HTTP/S, firewalls) and administration fundamentals for Windows and Linux environments.

Ngành nghề: CNTT - Phần mềm, CNTT - Phần cứng / Mạng

Kinh nghiệm: 1 Năm

Cấp bậc: Nhân viên

Hình thức: Nhân viên chính thức

Địa điểm: Hồ Chí Minh