Cyber Threat Intelligence & Incident Response Specialist
Whats on offer:
- 1 year contract (highly renewable)
- Environment: Non Consulting, End client environmnet
- Location: Singapore, Central
Overview
We are looking for a motivated cybersecurity professional to join our Cyber Defence team, supporting Threat Intelligence, Incident Response, Threat Hunting, and Security Operations. This role is ideal for someone with hands-on experience investigating security incidents and who is eager to further develop their technical expertise in cyber defence.
You will work alongside experienced security professionals to investigate cyber threats, improve detection capabilities, and strengthen the organisation's overall security posture across enterprise and cloud environments.
Key Responsibilities
Threat Intelligence
- Collect and analyse cyber threat intelligence from open-source intelligence (OSINT), commercial feeds, and industry sources.
- Monitor emerging threats, attacker techniques, and indicators of compromise (IOCs).
- Support the development of detection rules and threat hunting activities using threat intelligence.
Incident Response
- Investigate security alerts and assist with incident response activities, including triage, containment, recovery, and post-incident reviews.
- Analyse endpoint, network, identity, and cloud security events.
- Use EDR and SIEM platforms to investigate suspicious activity and support threat investigations.
- Document investigation findings and recommend remediation actions.
Threat Hunting & Detection
- Participate in proactive threat hunting activities across endpoint and cloud environments.
- Assist in creating and tuning detection rules within SIEM and EDR platforms.
- Support continuous improvements to monitoring and detection capabilities.
Cloud Security
- Investigate security events within AWS, Azure, or GCP environments.
- Review cloud logs to identify suspicious behaviour or potential security risks.
- Work with infrastructure and engineering teams to address identified issues.
Vulnerability Management
- Review newly disclosed vulnerabilities and assess potential organisational impact.
- Assist in validating security findings and tracking remediation activities.
- Monitor emerging threats and support response efforts where necessary.
Security Operations Improvement
- Identify opportunities to improve security monitoring and response processes.
- Assist in developing automation scripts and security playbooks.
- Contribute to operational documentation and incident response procedures.
Requirements
- 3-5 years of experience in Cybersecurity, SOC Operations, Incident Response, Threat Hunting, or Threat Intelligence.
- Experience working with SIEM and/or EDR platforms (such as Microsoft Defender, CrowdStrike, Sentinel, Splunk, QRadar, or similar).
- Exposure to investigating security incidents across endpoint, network, or cloud environments.
- Basic understanding of MITRE ATT&CK, attacker techniques, and incident response processes.
- Experience with one or more cloud platforms (AWS, Azure, or GCP) is advantageous.
- Familiarity with detection queries such as KQL, SPL, Sigma, or similar is beneficial but not mandatory.
- Basic scripting knowledge (Python, PowerShell, or Bash) is an advantage.
Preferred Qualifications
- Experience in a Security Operations Centre (SOC), Managed Security Services Provider (MSSP), or cyber consulting environment.
- Exposure to threat hunting, digital forensics, or malware analysis.
- Industry certifications such as Security+, CySA+, GSEC, GCIH, CEH, SC-200, AZ-500, or equivalent are advantageous.
- Strong analytical, troubleshooting, and communication skills with the ability to work collaboratively in a fast-paced environment.