Roles & Responsibilities:
- Continuously monitor and analyse security events and alerts from various sources, including SIEM, EDR/XDR, firewalls, IDS/IPS, endpoint security, network security, and other security infrastructure.
- Investigate and respond to security incidents, including complex and high-severity cybersecurity events.
- Conduct detailed analysis of security events, logs, network traffic, endpoint activities, and other relevant security data to determine the severity, impact, scope, and root cause of incidents.
- Perform advanced incident investigation and determine appropriate containment, eradication, recovery, and remediation actions.
- Conduct threat hunting activities to proactively identify suspicious activities, indicators of compromise (IOCs), attacker behaviours, and potential security threats.
- Develop and utilize threat-hunting queries and techniques to identify emerging threats and malicious activities.
- Analyse and correlate information from multiple security sources to identify attack patterns, anomalies, and potential security incidents.
- Perform analysis of malware, suspicious files, URLs, domains, IP addresses, and other indicators of compromise where required.
- Analyse threat intelligence and security research to identify emerging cybersecurity threats, vulnerabilities, attack techniques, and indicators that may affect the organisation or its customers.
- Apply recognised cybersecurity frameworks and methodologies, including MITRE ATT&CK, during security investigations and threat analysis.
- Develop, maintain, and improve SIEM correlation rules, detection rules, dashboards, alerts, and security monitoring use cases.
- Assist in tuning and optimizing security tools and detection mechanisms to improve detection accuracy, reduce false positives, and enhance overall SOC capabilities.
- Identify gaps in existing security monitoring and recommend improvements to security tools, processes, procedures, and detection capabilities.
- Coordinate with IT, network, infrastructure, application, and other technical teams to facilitate timely investigation, containment, and remediation of security incidents.
- Participate in the management and response of major or critical security incidents and provide technical recommendations to relevant stakeholders.
- Conduct root cause analysis and post-incident reviews and provide recommendations to prevent recurrence of security incidents.
- Prepare and maintain detailed incident reports, investigation findings, root cause analysis, remediation recommendations, and other security documentation.
- Develop and maintain incident response procedures, playbooks, investigation guides, and SOC operational documentation.
- Provide technical guidance and knowledge sharing to SOC team members to improve investigation and incident-handling capabilities.
- Participate in regular SOC meetings, cybersecurity training, tabletop exercises, knowledge-sharing sessions, and continuous improvement initiatives.
- Maintain up-to-date knowledge of cybersecurity threats, vulnerabilities, attack techniques, security technologies, and industry best practices.
- Perform other cybersecurity and SOC-related duties and responsibilities as assigned by management.
Key Requirements:
- Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Security, or a related field, or equivalent professional experience.
- Candidate MUST have 7 or more years of experience on overall cybersecurity incident response with 4+ years specifically on security usecase design, development, coding.
- Experience in SIEM on ELK(Elastic Logstash Kibana) stack is a plus
- Professional credentials in one of the relevant IT Security disciplines is a plus (SANS / CISSP / OSCP)
- Experience in common scripting languages such as Python, PowerShell, Bash, SQL is a plus
- Experience with Security Operations Centre (SOC) structure and incident response lifecycle
(detection → analysis → containment → recovery → reporting) - Hands-on experience with SIEM tools (e.g., LogRhythm, ELK, Splunk equivalent) – log monitoring, alert review, dashboard usage
- Experience in log analysis and threat detection concepts (Windows logs, firewall logs, authentication logs, etc.)
- Cybersecurity technologies such as PAM, EDR, XDR, SOAR, IDS/IPS, WAF, DLP (conceptual knowledge acceptable)
- Networking fundamentals (TCP/IP, DNS, HTTP, ports, firewalls)
- Exposure to cloud or platform security concepts (AWS/Azure/GCP basics acceptable)
- Ability to perform research on cybersecurity best practices and produce process/procedural documentation
- Willingness to support rostered weekend/night operations
Savita Rai
EA REG NO: R1873418
EA License No:23C2060
Disclaimer: The company is committed to ensuring the privacy and security of your information. By submitting this form, you consent to the collection, processing, and retention of the information you provide. The data collected (which may include your contact details, educational background, work experience and skills) will be used solely for the purpose of evaluating your qualifications for the position you're applying for. Your data will be stored securely and retained for the duration necessary to fulfill our hiring process. If you are not selected for the position, your data will be kept on file for a limited period in case future opportunities arise. You have the right to access, correct, or delete your data at any time by contacting us at Quess Singapore | A Leading Staffing Services Provider in Singapore (quesscorp.sg)
This is in partnership with the Employment and Employability Institute Pte Ltd (“e2i”).
e2i is the empowering network for workers and employers seeking employment and employability solutions. e2i serves as a bridge between workers and employers, connecting with workers to offer job security through job-matching, career guidance and skills upgrading services, and partnering employers to address their manpower needs through recruitment, training, and job redesign solutions. e2i is a tripartite initiative of the National Trades Union Congress set up to support nation-wide manpower and skills upgrading initiatives. By applying for this role, you consent to Quesscorp Singapore’s PDPA and e2i’s PDPA. By submitting your application for this position, you consent to the collection, use, and disclosure of your personal data by Quesscorp and its recruitment partners, including Employment and Employability Institute Pte Ltd, for the purpose of i) employment facilitation and ii) data and statistical analysis. You may find out more information on the PDPA policies at Quesscorp website and [https://www.e2i.com.sg/pdpa/]."