Cyber Security Operations Lead

We are seeking a Cyber Security Operations Lead. You will own detection and incident response in a regulated hedge fund environment, partnering with an outsourced SOC/MDR while tuning Microsoft Sentinel and Microsoft Defender. Based in Malaysia, you will support Singapore and regional offices with hands-on threat hunting, reporting and continuous control improvements.

Responsibilities

• Own and enhance Microsoft Sentinel detection content including analytics rules, workbooks, Kusto Query Language (KQL) and threat-hunting workflows
• Govern the outsourced SOC/MDR provider including onboarding, service reviews, escalation quality and service level agreement (SLA) performance
• Maintain security logging coverage across endpoint, identity, network and cloud environments
• Triage SOC escalations, assess severity, coordinate containment and drive incident communications
• Lead critical incident response through detection, containment, eradication, recovery and closure
• Oversee vulnerability scanning, remediation tracking, patch SLA compliance and cloud security posture improvements
• Deliver security operations reporting including key risk indicators (KRIs), key performance indicators (KPIs), mean time to detect (MTTD), mean time to respond (MTTR) and vendor performance
• Coach the Security Operations Analyst while maintaining runbooks, escalation paths, playbooks and audit-ready documentation

Requirements

• Proven experience in security operations, security operations center (SOC) leadership, detection engineering or incident response
• Hands-on expertise with Microsoft Sentinel including analytics rules, workbooks, Kusto Query Language (KQL), threat hunting and detection tuning
• Strong background with Microsoft Defender, especially Microsoft Defender for Endpoint and Microsoft Defender for Cloud
• Demonstrated ability to manage or partner with an outsourced SOC/MDR provider including SLA governance and escalation management
• Working knowledge of incident triage, response coordination, post-incident reviews and detection improvement
• Practical understanding of vulnerability management, patch governance, threat intelligence and cloud security posture management (CSPM)
• Ability to collaborate with security architecture, engineering and project delivery teams to improve detection and response outcomes
• Clear communication with confidence translating technical metrics into business-relevant reporting for senior leaders

Nice to have

• Experience working in regulated financial services such as asset management, investment management or hedge funds
• Microsoft certifications such as SC-200 or AZ-500 or industry certifications such as GCIA, GCIH or CISSP
• Experience integrating threat intelligence feeds and indicators of compromise (IOCs) into detection workflows

Benefits

• By choosing EPAM, you're getting a job at one of the most loved workplaces according to Newsweek 2021 & 2022&2023.

• Employee ideas are the main driver of our business. We have a very supportive environment where your voice matters

• You will be challenged while working side-by-side with the best talent globally. We work with top-notch technologies, constantly seeking new industry trends and best practices

• We offer a transparent career path and an individual roadmap to engineer your future & accelerate your journey

• At EPAM, you can find vast opportunities for self-development: online courses and libraries, mentoring programs, partial grants of certification, and experience exchange with colleagues around the world. You will learn, contribute, and grow with us