SOC monitoring investigation specialist

• Monitor information security alerts on the SIEM and security appliances on a shift roster.
• Triage, verify and investigate alerts; tell false positives from real incidents.
• Investigate system logs, network traffic and endpoint data in depth to reconstruct the attack chain.
• Coordinate incident handling and remediation: isolate infected machines, block indicators of compromise, restore services.
• Write incident reports and periodic reports, and recommend preventive measures for customers.
• Take part in proactive threat hunting and build new detection rules against the MITRE ATT&CK framework.
• Keep up to date on new vulnerabilities, malware and attack campaigns in the region.

• At least 1 year in information security monitoring, system administration or network administration.
• Good understanding of network protocols and of Windows and Linux, to the level of analyzing logs.
• Hands-on with at least one SIEM platform (Splunk, QRadar, Wazuh, Elastic Security) or an EDR solution.
• Familiar with common attack techniques and the MITRE ATT&CK framework.
• Investigative mindset, careful, thorough in note-taking and honest with data.
• Willing to work rotating shifts, including night shifts (shift allowance and time off in lieu provided).
• Preference for candidates holding CEH, CompTIA Security+, GCIA or GCIH, or with results in information security competitions.

Information security monitoring · Incident response

• Income from 20 – 45 million VND/month, negotiable based on your ability and interview results.
• The salary discussed is net take-home income — the company covers social insurance, health insurance, unemployment insurance and personal income tax, so you receive the full agreed amount.
• Salary reviews twice a year; quarterly performance bonus and a 13th-month salary.
• Bonuses for public holidays, Tết, birthdays and long service, plus spot bonuses when a project lands.
• Full insurance contributions on your actual salary from the probation month onwards.
• Extended health insurance for permanent staff; annual health check-up.
• 12 days of annual leave a year, plus 1 more day for every year of service; public holidays as required by law.
• The company pays training and exam fees for international certifications along each role's track (AWS, Microsoft Azure, Google Cloud, CCNA/CCNP, CISSP, CEH, PMP, Scrum…).
• Work equipment provided as the job requires, plus an internal cloud infrastructure account for self-study and experimentation.
• A clearly published competency framework and promotion path, reviewed every 6 months.
• Opportunities to join projects with customers and group offices in Japan, Korea, Singapore, Australia, the United States and Dubai.
• Team-building activities, an annual company trip and sports clubs; our offices are in Grade A buildings.

Monday – Friday: 08:30 – 17:30, lunch break 12:00 – 13:30, working at the office.
Saturday: 08:30 – 12:00, working from home — no need to come into the office.
Sunday and statutory public holidays: off.
Work-from-home policy: up to 10 work-from-home days in every 30 days (Saturdays included), registered in advance with your direct manager.
No unplanned overtime. Roles on system duty follow a separate shift schedule, with a shift allowance and compensating days off.

You choose one of the three domestic offices when you apply: Ho Chi Minh City, Hanoi or Da Nang.
The group also has offices in Tokyo, Osaka, Fukuoka (Japan), Seoul (Korea), Sydney (Australia), California (United States), Singapore and Dubai — staff have the chance to work onsite or rotate by project.
The full address of each office is published in the website footer.

• Click “Apply now” and submit your CV directly in the system (PDF or Word, under 5 MB).
• Select the office you want to work at right on the application form — each position only shows the offices currently hiring for it.
• In your CV, please state the position you are applying for and your expected net take-home income.
• Selection process: CV screening within 5 working days → technical interview → interview with the hiring manager → offer letter.
• Applications are kept confidential and used only for HiTechCloud's recruitment purposes.