Mô tả công việc
Make an impact with NTT DATA
Join a company that is pushing the boundaries of what is possible. We are renowned for our technical excellence and leading innovations, and for making a difference to our clients and society. Our workplace embraces diversity and inclusion – it’s a place where you can grow, belong and thrive.
Your day at NTT DATA
NTT DATA Vietnam is seeking a motivated and detail-oriented SOC Engineer L2 to join our Security Operations Center (SOC) team in Hanoi.
As a Level 2 SOC Engineer, you will be responsible for investigating and handling security incidents escalated from L1 analysts, conducting in-depth threat analysis, validating security events, performing incident response activities, and supporting threat hunting initiatives.
This role requires strong analytical skills, hands‑on experience with SIEM and EDR platforms, cybersecurity incident investigation expertise, and excellent English communication skills to engage effectively with global customers, regional SOC teams, and cybersecurity stakeholders.
Key Responsibilities
Security Incident Investigation & Analysis
- Perform detailed investigation and analysis of security incidents escalated from SOC L1.
- Analyze security events from SIEM, EDR, cloud security platforms, firewalls, network devices, and endpoint systems.
- Validate security alerts and determine severity, impact, and root causes.
- Conduct log correlation and attack chain analysis across multiple security technologies.
- Identify Indicators of Compromise (IOC), Indicators of Attack (IOA), and adversary tactics, techniques, and procedures (TTPs).
Incident Response & Containment
- Lead incident triage, investigation, containment, eradication, and recovery activities.
- Coordinate with customer security teams and internal stakeholders during incident handling.
- Provide technical recommendations for remediation and risk mitigation.
- Participate in major incident bridges and cybersecurity response activities.
- Develop incident reports, root cause analyses, and lessons‑learned documentation.
Threat Detection & Threat Hunting
- Perform proactive threat hunting activities across customer environments.
- Investigate suspicious behavior based on threat intelligence feeds and emerging threats.
- Leverage MITRE ATT&CK framework to map attacker behaviors and identify detection gaps.
- Develop hypotheses and conduct advanced investigations to uncover hidden threats.
- Recommend detection improvements and security use cases.
Security Monitoring & SIEM Operations
- Analyze and optimize SIEM use cases, correlation rules, and alert tuning.
- Support onboarding of new log sources and security technologies.
- Develop and improve detection content for customer environments.
- Identify false positives and improve alert accuracy.
- Support operational health monitoring of SOC platforms.
Security Tool Administration Support
Work with technologies including:
SIEM Platforms
- Microsoft Sentinel
- Splunk Enterprise Security
- IBM QRadar
- ArcSight
Endpoint Security
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
- Palo Alto Cortex XDR
- SentinelOne
Security Technologies
- IDS/IPS
- Firewalls
- Network Security Monitoring
- Email Security
- Cloud Security Platforms
Customer Communication & Reporting
- Communicate investigation findings and recommendations to customers.
- Conduct incident review meetings and technical discussions in English.
- Prepare executive and technical incident reports.
- Provide updates during incident response engagements.
- Support customer audits and compliance‑related requests.
Process Improvement
- Contribute to SOC playbook development and continuous improvement initiatives.
- Develop knowledge articles and operational procedures.
- Mentor and provide technical guidance to L1 SOC Engineers.
- Participate in security automation and SOAR implementation activities.
- Support SOC maturity improvement programs.
Required Qualifications
Education
- Bachelor's Degree in Cybersecurity, Information Security, Computer Science, Information Technology, Network Engineering, or a related discipline.
Experience
- Minimum 3‑5 years of experience in:
- Security Operations Center (SOC)
- Incident Response
- Cybersecurity Operations
- Security Monitoring
- Threat Detection
- At least 2 years of hands‑on experience working in an enterprise SOC environment.
- Experience supporting international customers is highly preferred.
Technical Skills
Cybersecurity Knowledge
Strong understanding of:
- Security Operations Center processes
- Incident Response Lifecycle
- Threat Detection and Monitoring
- Threat Hunting Methodologies
- Network Security
- Endpoint Security
- Cloud Security
- Security Architecture Principles
Operating Systems
Hands‑on knowledge of:
- Microsoft Windows
- Active Directory
- Linux Administration
- Windows Event Logs
- Linux Security Logs
Networking
Strong understanding of:
- TCP/IP
- DNS
- HTTP/HTTPS
- SMTP
- VPN
- Network Traffic Analysis
- Firewalls
- Proxy Technologies
Cloud Security
Experience with one or more platforms:
- Microsoft Azure
- Microsoft Defender Suite
- AWS Security Services
- Google Cloud Security
Security Frameworks
Working knowledge of:
- MITRE ATT&CK
- NIST Cybersecurity Framework
- Cyber Kill Chain
- ISO 27001
- CIS Controls
Scripting & Automation (Preferred)
Basic knowledge of:
- PowerShell
- Python
- KQL (Kusto Query Language)
- Splunk SPL
- Sigma Rules
Language Requirements
English Communication (Mandatory)
- Strong verbal and written English communication skills.
- Ability to independently communicate with international customers and global security teams.
- Ability to conduct incident briefings and technical discussions in English.
- Experience writing professional incident reports and technical documentation in English.
- Comfortable participating in conference calls, governance meetings, and security review sessions with global stakeholders.
Vietnamese
- Native or professional working proficiency.
Preferred Certifications
One or more of the following certifications is highly desirable:
Security Certifications
- CompTIA Security+
- CompTIA CySA+
- EC-Council CEH
- GIAC GSEC
- GIAC GCIA
- GIAC GCIH
- Microsoft SC-200
- Microsoft AZ-500
- Cisco CyberOps Professional
Advanced Certifications (Advantage)
- CISSP
- CISM
- CCSP
- GCFA
- GCTI
Soft Skills
- Strong analytical and investigative mindset.
- Excellent troubleshooting and problem‑solving skills.
- Ability to remain calm under pressure during security incidents.
- Attention to detail and strong documentation capabilities.
- Customer‑focused attitude.
- Ability to mentor junior analysts.
- Strong teamwork and stakeholder management skills.
Work Environment
- 24x7 Security Operations Center environment in the future.
- Shift‑based working schedule, including night shifts and weekends based on operational requirements in the future.
- Collaboration with local, regional, and global cybersecurity teams.
- Opportunity to work with enterprise customers across multiple industries.
Benefits
- Competitive salary package
- Exposure to enterprise‑scale infrastructure and real production systems.
- Training and career development toward L3 / System Specialist / Cloud Engineer.
- Full social insurance coverage based on salary.
- Probation with 100% salary.
- Annual bonuses and regular salary reviews.
- Training sponsorship for professional courses and certification exams.
- Comprehensive healthcare coverage for staff and their families.
- Regular health check‑ups.
- 15 days of paid annual leave, plus 1 additional day for every 3 years of service, up to 20 days.
Work Locations
Hanoi Office: Room 202, 2nd Floor, HITC Building, 239 Xuan Thuy street, Dich Vong Hau ward, Cau Giay District, Hanoi, Or Gia Lam District (Client’s location)
About NTT DATA
NTT DATA is a $30+ billion business and technology services leader, serving 75% of the Fortune Global 100. We are committed to accelerating client success and positively impacting society through responsible innovation. We are one of the world’s leading AI and digital infrastructure providers, with unmatched capabilities in enterprise‑scale AI, cloud, security, connectivity, data centers and application services. Our consulting and industry solutions help organizations and society move confidently and sustainably into the digital future. As a Global Top Employer, we have experts in more than 70 countries. We also offer clients access to a robust ecosystem of innovation centers as well as established and start‑up partners. NTT DATA is part of NTT Group, which invests over $3 billion each year in R&D.
Equal Opportunity Employer
NTT DATA is proud to be an Equal Opportunity Employer with a global culture that embraces diversity. We are committed to providing an environment free of unfair discrimination and harassment. We do not discriminate based on age, race, colour, gender, sexual orientation, religion, nationality, disability, pregnancy, marital status, veteran status, or any other protected category. Join our growing global team and accelerate your career with us. Apply today.
Third parties fraudulently posing as NTT DATA recruiters
NTT DATA recruiters will never ask job seekers or candidates for payment or banking information during the recruitment process, for any reason. Please remain vigilant of third parties who may attempt to impersonate NTT DATA recruiters whether in writing or by phone in order to deceptively obtain personal data or money from you. All email communications from an NTT DATA recruiter will come from an @nttdata.com email address. If you suspect any fraudulent activity, please
contact us
.