Cyber Incident Responder

Position Purpose

We are looking for a Cybersecurity expert/SME in Detection Engineering and Security Investigation areas, as part of the Production SOC, Security Investigation and Incident Response team.

Your role will be to:

1. Strengthen detection capabilities across APAC and contribute to the global use case development programme to ensure alignment of security detection use cases.
2. Contribute to the enhancement of SIEM and SOAR capabilities.
3. Act as a reference point within a team of experts on Security Incident Response, Anti-Malware/Defense and Security Detection activities.
4. Oversee detection capabilities supporting the regional IT Production SOC.
5. Participate in the continuous improvement of tools and processes relating to Security Incident Management, Anti-Malware/Defense and Security Detection.
6. Collaborate with regional security teams to strengthen security monitoring and incident response capabilities.

Key Responsibilities

Direct Responsibilities

• Lead technical activities (security usecase definition, design, implementation & enrichment) in the team of IT Production Security Investigation & Incident Response based on real-world attack scenarios and framework like MITRE ATT&CK, ensuring robust security detection posture across various layers.
• Understand ongoing security threats in the wild and propose security usecase to detect and when possible, protect or mitigate.
• Be autonomous on technical activities (definition, R&D/threat hunting) in the team of IT Production Security Investigation & Incident Response and oversee the detection capabilities of the 24/7 regional IT Production SOC
• Respond to Cyber / IT security incidents and evaluates the type and severity of security events.
• Identify recurring security issues and risks and develops mitigation plans and recommends process improvements.
• Partner with global, regional and local stakeholders to ensure organizational and procedural efficiency and readiness for detection of suspicious events and reaction
• Continuously improve the processes to strengthen the current SOC framework via review of policies and operational playbooks

Contributing Responsibilities

• Partner with the APAC Business CSIRT for integrated security monitoring and alert/incident handling operations.
• Contribute to local security incident response outside the direct scope of responsibilities (i.e., local IT production in some APAC business entities)
• Contribute to the Bank compliance with regulatory requirements and internal policies
• Contribute to the reporting of all incidents according to the Incident Management System
• Contribute to the control frameworks in day‐to‐day business activities, such as Control Plan; Participate to Audit interview and provide the require evidence.

Competencies (Technical / Behavioural)

Role Specific Technical Skills

• Requires roughly 7 years of experience as a cybersecurity professional.
• Strong experience in security use case design, development and enhancement within security monitoring and incident response environments.
• Strong hands-on experience with Python and JavaScript.
• Good working knowledge of Linux (RedHat/Ubuntu).
• Ability to interpret security logs, attack patterns and threat intelligence into detection logic and actionable security use cases.
• Strong SecOps / DevOps mindset with experience building security automation and operational tooling.
• Experience and knowledge in investigating incidents, remediation, tracking and follow-up for incident closure with concerned teams, stakeholders.
• Thorough understanding of technologies and security concepts, with knowledge & hands on experience in SIEM Product and Security Incident Management
• Strong L3 experience in incident response activities including threat hunting, event analysis, incident investigation and reporting.
• Comfortable working with and making the most of large data sets (collection, analysis, response), creating content/use cases/models and bringing an automation mindset.

Personal Attributes

• Strong problem-solving skills.
• Good communication skills.
• Positive attitude with a willingness to learn and perform in-depth technical investigations.
• Ability to work independently, think critically and take initiative.
• Strong interpersonal and teamwork skills.
• High level of accountability and ownership.
• Ability to manage multiple priorities and deliver within agreed timelines.
  

Specific Preferred Qualifications

• Minimum 7 years of cybersecurity experience with a strong focus on Security Operations, Incident Response, Threat Detection or Detection Engineering.
• Proven experience operating at an L3 Incident Response level.
• Minimum 4 years of experience in security use case design, development, coding and detection engineering activities.
• Hands-on experience developing and maintaining custom security use cases and detection content.
• Strong working knowledge of both Python and JavaScript is mandatory.
• Experience working with on-premises security environments and customised security tooling.
• Experience with ELK (Elastic, Logstash, Kibana) is highly desirable.
• Banking or financial services experience is advantageous.
• Professional credentials in one of the relevant IT Security disciplines is a plus (SANS / CISSP / OSCP)
• Experience in common scripting languages such as PowerShell, Bash, SQL is a plus

We regret to inform that only shortlisted candidates will be notified.

EA registration number : Ng Xuan, R24123530

Allegis Group Singapore Pte Ltd, Company Reg No. 200909448N, EA Licence No. 10C4544