This is a hands-on technical role focused on proactive threat hunting, cyber incident response, detection engineering and enterprise security posture improvement.
The successful candidate will work closely with SOC, CISO, infrastructure, network and cloud teams to identify emerging threats, investigate security incidents and drive continuous improvements in cyber resilience across a complex enterprise environment.
Key Responsibilities
-
Lead technical investigations and coordinate incident response activities, including threat triage, containment, remediation and root cause analysis.
-
Conduct proactive threat hunting across enterprise infrastructure using SIEM, EDR, NDR and other security monitoring technologies.
-
Identify sophisticated attack patterns, lateral movement, privilege misuse, anomalous activities and potential indicators of compromise.
-
Develop and enhance threat hunting methodologies, detection use cases, investigation playbooks and incident response procedures.
-
Collaborate with SOC and cybersecurity teams to strengthen detection capabilities, improve alert quality and address security monitoring gaps.
-
Support vulnerability management and risk-based remediation by assessing exposure, asset criticality and emerging threats.
-
Contribute to enterprise security initiatives involving Zero Trust, network detection and response, micro-segmentation, identity security and asset discovery.
-
Participate in security assessments, incident simulations and tabletop exercises to improve organisational readiness.
-
Provide technical recommendations, investigation findings and security posture updates to relevant stakeholders.
Requirements
-
Minimum 7 years of experience in cybersecurity operations, incident response, threat hunting, SOC operations, detection engineering or infrastructure security.
-
Strong hands-on experience with SIEM, EDR, NDR, vulnerability management and security monitoring technologies.
-
Solid understanding of the cyber incident response lifecycle, threat investigation techniques and attacker methodologies.
-
Good knowledge of network security, Windows/Linux environments, Active Directory, authentication protocols and cloud security fundamentals.
-
Familiarity with MITRE ATT&CK, Cyber Kill Chain and threat hunting methodologies.
-
Experience analysing endpoint telemetry, network traffic, security logs and suspicious user activities.
-
Ability to work effectively across technical teams and communicate complex security findings to stakeholders.
-
Strong analytical, troubleshooting and problem-solving capabilities.
-
Hands-on exposure to security platforms such as Microsoft Sentinel, Splunk, CrowdStrike, Darktrace, Palo Alto, Tenable, Qualys or similar technologies.
-
Scripting and automation experience using Python, PowerShell, KQL, SPL or APIs.
-
Relevant certifications such as GCIH, GCIA, GCFA, GNFA, CISSP, CISM or equivalent.
-
Experience supporting enterprise cybersecurity transformation initiatives, including Zero Trust, IAM/PAM and micro-segmentation.
-
Background in large-scale enterprise, telecommunications, critical infrastructure or regulated environments.
Morgan Mckinley Pte Ltd
EA Licence No: 11C5502
EAP Registration No: R1106192
