38 Threat Detection jobs in Singapore
Senior Analyst, Threat Detection and Response
Posted today
Job Viewed
Job Description
Senior Analyst, Threat Detection and Response
Headquartered in Singapore, SATS Ltd. is one of the world’s largest air cargo handling and airline catering services. SATS Gateway Services delivers airfreight, ground handling, security, aircraft cleaning and laundry. SATS Food Solutions supplies airlines and institutions with central kitchens for large‐scale food production and distribution.
Key Responsibilities
Continuously monitor SIEM, EDR and other consoles for suspicious activity; triage alerts and prioritize response based on asset criticality.
Investigate suspicious events, determine incident scope, gather evidence and perform root‐cause analysis to identify attack vectors.
Execute end‐to‐end incident response, including containment, eradication, recovery and coordination with IT infrastructure and application owners.
Proactively hunt for indicators of compromise and hidden threats in logs, network traffic and endpoint telemetry, employing hypothesis‐driven techniques.
Continuously tune SIEM/EDR rules, thresholds and SOAR playbooks to automate response actions, reduce false positives and accelerate containment.
Leverage threat intelligence sources to enrich analysis and response; stay updated on new vulnerabilities and adversary tactics; adjust monitoring rules accordingly.
Work closely with global SOC team members and escalating complex incidents to senior analysts or incident response leads when necessary.
Document investigation steps, findings, and actions taken; prepare incident reports and contribute to post‐incident reviews.
Assist in developing and updating incident response playbooks, SOPs and knowledge base documentation; provide feedback to improve monitoring tools and workflow automation.
Share insights from incidents and trending threats with the broader team; mentor junior analysts (Tier 1 SOC analysts) by elevating the team’s collective skill level.
Key Requirements
Bachelor’s degree in Cybersecurity, Computer Science, Information Systems or equivalent threat management & incident response experience.
Currently hold cybersecurity certifications such as GCIH, GCFA, GCIA, CEH or others.
With 3 years or more, progressive experience in at least two of the following disciplines:
Threat Detection & Analysis (leveraging SIEM tools, IDS/IPS, endpoint detection, log analysis).
Incident Response & Management (developing response plans, executing playbooks, forensic investigations, root cause analysis).
Threat Hunting (identifying undetected threats through proactive analysis and hypothesis‐driven investigation).
Cyber Threat Intelligence (gathering and analyzing threat intelligence to inform detection capabilities and preventive measures).
Network Security (TCP/IP protocols, firewalls, intrusion prevention systems, and network traffic analysis).
Securing and monitoring operating system and cloud environments (AWS, Azure, GCP), including analyzing cloud service logs and configurations for suspicious activities.
Demonstrated ability to function as a Level 2 or 3 SOC Analyst (analyzing and responding to cybersecurity incidents).
Preferred Experience:
Experience with SOAR tools and some proficiency in scripting languages (e.g., Python, PowerShell) to automate repetitive tasks.
Advanced understanding of emerging threats, zero‐day vulnerabilities, and common attack vectors (phishing, malware, ransomware, lateral movement).
Hands‐on experience using SIEM and EDR platforms for centralized log analysis and real‐time threat monitoring.
In‐depth knowledge of the incident response lifecycle.
Proven ability to conduct proactive threat hunting operations, leveraging the MITRE ATT&CK framework.
Familiarity with cyber threat intelligence feeds and standards (STIX, TAXII) and incorporating IOCs into monitoring and investigations.
Understanding of key security frameworks and regulations (NIST CSF, ISO 27001, GDPR) and the ability to align threat detection and incident response processes with organizational policies.
Effective at coordinating with cross‐functional teams during high‐impact incidents and translating complex technical findings into actionable insights for executive and non‐technical stakeholders.
#J-18808-Ljbffr
Senior Analyst, Threat Detection and Response
Posted today
Job Viewed
Job Description
About Us
Headquartered in Singapore, SATS Ltd. is one of the world's largest providers of air cargo handling services and Asia's leading airline caterer. SATS Gateway Services provides airfreight and ground handling services including passenger services, ramp and baggage handling, aviation security services, aircraft cleaning and aviation laundry. SATS Food Solutions serves airlines and institutions, and operates central kitchens with large-scale food production and distribution capabilities for a wide range of cuisines.
SATS is present in the Asia-Pacific, the Americas, Europe, the Middle East and Africa, powering an interconnected world of trade, travel and taste. Following the acquisition of Worldwide Flight Services (WFS) in 2023, the combined SATS and WFS network operates over 215 stations in 27 countries. These cover trade routes responsible for more than 50% of global air cargo volume. SATS has been listed on the Singapore Exchange since May 2000. For more information, please visit
Why Join Us
At SATS, people are our greatest asset and we build our success on the knowledge, expertise and performance of every contributor, by embracing diversity and uniqueness. As part of our holistic approach and commitment to embracing FAM (Fulfilling, Appreciated, Meaningful) in the workplace, we offer the runway to develop Fulfilling careers that foster your career growth, recognising and Appreciating the strength of talent and capabilities that we continue to build internally; and inspiring and encouraging each other to make Meaningful contributions in the work we do at SATS.
Key Responsibilities
This position focuses on threat detection, incident response, event analysis, and proactive threat hunting across the organization's IT environments. The Threat Detection and Response Sr. Analyst monitors security systems, analyzes alerts, and investigates potential incidents to protect critical assets and data. Serving as an integral part of the global Security Operations Center (SOC) team, this analyst works closely with regional teams in Europe and Singapore to ensure timely identification and remediation of cyber threats.
The senior analyst will respond to security incidents in accordance with established procedures and industry best practices, collaborating with cross-functional IT and security teams. They leverage advanced security tools (SIEM, EDR, SOAR) and follow frameworks like MITRE ATT&CK to understand adversary techniques and continuously improve detection capabilities. The ideal candidate has 3+ years of experience in cybersecurity operations (Tier 2 / Tier 3 SOC analyst or incident responder), combining strong technical skills with effective communication.
Continuously monitor security consoles and dashboards (SIEM, EDR, etc.) for suspicious activity; triage alerts to identify valid security incidents versus false positives and prioritize response based on asset criticality and business risk.
Investigate suspicious activities and security events, determine the scope and severity of incidents, and gather relevant evidence. Perform root cause analysis to identify attack vectors and affected systems.
Execute incident response actions end-to-end - including timely containment of threats, eradication of malicious artifacts, and system recovery - following the organization's incident response plan. Coordinate with IT infrastructure, application owners, and other stakeholders to ensure effective remediation of incidents.
Proactively hunt for indicators of compromise and hidden threats in logs, network traffic, and endpoint telemetry, even without specific alerts. Use hypothesis-driven techniques and knowledge of attacker TTPs to uncover stealthy or emerging threats that evaded initial detection.
Continuously tune SIEM/EDR detection rules, thresholds, and SOAR playbooks—automating repetitive response actions to reduce false positives and accelerate containment
Leverage internal and external threat intelligence sources to enrich analysis and response. Stay updated on new vulnerabilities and adversary tactics; incorporate this knowledge to adjust monitoring rules and incident response strategies. Map observed malicious activities to frameworks like MITRE ATT&CK for reporting and analysis.
Work closely with global SOC team members and escalate complex incidents to senior analysts or incident response leads when necessary. Collaborate with colleagues in other regions to ensure seamless coverage and knowledge sharing across the security team.
Document investigation steps, findings, and actions taken for each incident in a clear and concise manner. Prepare incident reports and contribute to post-incident review meetings, highlighting what occurred, how it was resolved, and recommendations to prevent future occurrences.
Assist in developing and updating incident response playbooks, standard operating procedures, and knowledge base documentation. Provide feedback and suggestions to improve security monitoring tools, analytics content (detection rules), and workflow automation (SOAR playbooks) for greater efficiency and effectiveness.
Share insights from incidents and trending threats with the broader team to enhance overall awareness. Mentor and guide junior analysts (Tier 1 SOC analysts) by sharing analysis techniques and best practices, elevating the team's collective skill level.
Key Requirements
Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or equivalent threat management & incident response experience
Currently hold cybersecurity certifications such as GCIH, GCFA, GCIA, CEH, others
With 3 years or more, progressive experience in at least two of the following disciplines:
Threat Detection & Analysis (leveraging SIEM tools, IDS/IPS, endpoint detection, log analysis, etc.)
Incident Response & Management (developing response plans, executing playbooks, forensic investigations, root cause analysis)
Threat Hunting (identifying undetected threats through proactive analysis and hypothesis-driven investigation)
Cyber Threat Intelligence (gathering and analyzing threat intelligence to inform detection capabilities and preventive measures)
Network Security (TCP/IP protocols, firewalls, intrusion prevention systems, and network traffic analysis)
Securing and monitoring operating system and cloud environments (AWS, Azure, GCP), including analyzing cloud service logs and configurations for suspicious activities, and understanding cloud-native security controls and best practices
Demonstrated ability to:
Function as a Level 2 or 3 SOC Analyst (analyzing and responding to cybersecurity incidents)
Preferred Experience:
Experience with SOAR tools and some proficiency in scripting languages (e.g., Python, PowerShell) to automate repetitive tasks and streamline incident response workflows
Advanced understanding of emerging threats, zero-day vulnerabilities, and common attack vectors (phishing, malware, ransomware, lateral movement) with the ability to ensure rapid detection and response
Hands-on experience using SIEM and EDR platforms for centralized log analysis, real-time threat monitoring, and in-depth incident investigations
In-depth knowledge of the incident response lifecycle
Proven ability to conduct proactive threat hunting operations, leveraging the MITRE ATT&CK framework to map adversary tactics, techniques, and procedures (TTPs), uncover stealthy threats, and close gaps in detection coverage
Familiarity with cyber threat intelligence feeds and standards (e.g., STIX, TAXII), incorporating IOCs (Indicators of Compromise) and threat intel data into monitoring and investigations to enrich context and anticipate emerging threats
Understanding of key security frameworks and regulations (e.g., NIST CSF, ISO 27001, GDPR) and the ability to align threat detection and incident response processes with organizational policies and compliance requirements
Effective at coordinating with cross-functional teams (IT, DevOps, Business, etc.) during high-impact incidents and translating complex technical findings into clear, actionable insights for executive and non-technical stakeholders
#J-18808-Ljbffr
Senior Information Security Analyst, Cyber Threat Detection
Posted 6 days ago
Job Viewed
Job Description
Singapore, Singapore
**Hours:**
40
**Line of Business:**
Technology Solutions
**Pay Details:**
We're committed to providing fair and equitable compensation to all our colleagues. As a candidate, we encourage you to have an open dialogue with a member of our HR Team and ask compensation related questions, including pay details for this role.
**Job Description:**
**Role and Responsibilities** **:**
**We are seeking an experienced and technically proficient Senior Information Security Analyst (L9) to join the Cyber Threat Detection (CTD) team. This role will focus on developing and tuning detection alerts for the Cyber Security Operations Center (CSOC), with a strong emphasis on engineering use cases, alert fidelity, and automated response integration.**
**Key Responsibilities:**
+ **Detection Engineering & Alert Development**
+ Design, implement, and tune detection logic for Microsoft Defender for Identity (MDI), Defender for Endpoint (MDE), and Defender for Office (MDO) alerts.
+ Build and maintain detection use cases aligned with threat models and business risk profiles
+ Collaborate with CSOC to ensure alert coverage, reduce false positives, and improve triage efficiency
+ **Security Use Case Lifecycle**
+ Own the end-to-end lifecycle of security use cases: from ideation and threat modeling to deployment and continuous tuning
+ Develop and maintain triage playbooks and enrichment logic for alerts.
+ Integrate detection logic with XSOAR playbooks for automated response
+ **Operational Support & Collaboration**
+ Partner with Threat Hunting, CSIRT, CSOC, and infrastructure teams to validate alert efficacy and ensure operational readiness.
+ Participate in incident response efforts by providing detection context and supporting investigations
+ Contribute to weekly CSOC reporting and metrics reviews to assess alert performance and coverage
+ **Project-Specific Contributions**
+ Support the E5 uplift by reviewing Microsoft security alerts and aligning them with enterprise threat models.
+ Assist in the synchronization of MDI/XDR incidents with XSOAR and ensure CSOC access and playbook readiness
**Qualifications:**
+ 7+ years of experience in information security, with at least 5 years in detection engineering or SOC operations
+ Deep understanding of SIEM/SOAR platforms (e.g., Splunk, XSOAR), Microsoft Defender suite, and threat detection methodologies
+ Strong scripting and automation skills (Python, PowerShell, etc.)
+ Familiarity with MITRE ATT&CK framework and threat modeling practices
+ Excellent communication and collaboration skills across technical and non-technical stakeholders
**Preferred Certifications:**
+ CISSP, GIAC (GCIA, GCIH, GCED), Microsoft SC-200, or equivalent
**Who We Are**
TD is one of the world's leading global financial institutions and is the fifth largest bank in North America by branches/stores. Every day, we deliver legendary customer experiences to over 27 million households and businesses in Canada, the United States and around the world. More than 95,000 TD colleagues bring their skills, talent, and creativity to the Bank, those we serve, and the economies we support. We are guided by our vision to Be the Better Bank and our purpose to enrich the lives of our customers, communities and colleagues.
TD is deeply committed to being a leader in customer experience, that is why we believe that all colleagues, no matter where they work, are customer facing. As we build our business and deliver on our strategy, we are innovating to enhance the customer experience and build capabilities to shape the future of banking. Whether you've got years of banking experience or are just starting your career in financial services, we can help you realize your potential. Through regular leadership and development conversations to mentorship and training programs, we're here to support you towards your goals. As an organization, we keep growing - and so will you.
**Our Total Rewards Package**
Our Total Rewards package reflects the investment we make in our colleagues to help them, and their families achieve their well-being goals. Total Rewards at TD includes a base salary and several other key plans such as health and well-being benefits, including medical coverage, paid time off, career development, and reward and recognition programs.
**Additional Information:**
We're delighted that you're considering building a career with TD. Through regular development conversations, training programs, and a competitive benefits plan, we're committed to providing the support our colleagues need to thrive both at work and at home.
**Colleague Development**
If you're interested in a specific career path or are looking to build certain skills, we want to help you succeed. You'll have regular career, development, and performance conversations with your manager, as well as access to an online learning platform and a variety of mentoring programs to help you unlock future opportunities. Whether you have a passion for helping customers and want to expand your experience, or you want to coach and inspire your colleagues, there are many different career paths within our organization at TD - and we're committed to helping you identify opportunities that support your goals.
**Training & Onboarding**
We will provide training and onboarding sessions to ensure that you've got everything you need to succeed in your new role.
**Interview Process**
We'll reach out to candidates of interest to schedule an interview. We do our best to communicate outcomes to all applicants by email or phone call.
**Accommodation**
If you require an accommodation for the recruitment / interview process (including alternate formats of materials, or accessible meeting rooms or other accommodation), please let us know and we will work with you to meet your needs.
Federal law prohibits job discrimination based on race, color, sex, sexual orientation, gender identity, national origin, religion, age, equal pay, disability and genetic information.
Senior Information Security Analyst, Cyber Threat Detection
Posted today
Job Viewed
Job Description
Job Description
Role and Responsibilities
We are seeking an experienced and technically proficient Senior Information Security Analyst (L9) to join the Cyber Threat Detection (CTD) team. This role will focus on developing and tuning detection alerts for the Cyber Security Operations Center (CSOC), with a strong emphasis on engineering use cases, alert fidelity, and automated response integration.
Detection Engineering & Alert Development
Design, implement, and tune detection logic for Microsoft Defender for Identity (MDI), Defender for Endpoint (MDE), and Defender for Office (MDO) alerts.
Build and maintain detection use cases aligned with threat models and business risk profiles
Collaborate with CSOC to ensure alert coverage, reduce false positives, and improve triage efficiency
Security Use Case Lifecycle
Own the end-to-end lifecycle of security use cases: from ideation and threat modeling to deployment and continuous tuning
Develop and maintain triage playbooks and enrichment logic for alerts.
Integrate detection logic with XSOAR playbooks for automated response
Operational Support & Collaboration
Partner with Threat Hunting, CSIRT, CSOC, and infrastructure teams to validate alert efficacy and ensure operational readiness.
Participate in incident response efforts by providing detection context and supporting investigations
Contribute to weekly CSOC reporting and metrics reviews to assess alert performance and coverage
Project-Specific Contributions
Support the E5 uplift by reviewing Microsoft security alerts and aligning them with enterprise threat models.
Assist in the synchronization of MDI/XDR incidents with XSOAR and ensure CSOC access and playbook readiness
Qualifications
7+ years of experience in information security, with at least 5 years in detection engineering or SOC operations
Deep understanding of SIEM/SOAR platforms (e.g., Splunk, XSOAR), Microsoft Defender suite, and threat detection methodologies
Strong scripting and automation skills (Python, PowerShell, etc.)
Familiarity with MITRE ATT&CK framework and threat modeling practices
Excellent communication and collaboration skills across technical and non-technical stakeholders
Preferred Certifications
CISSP, GIAC (GCIA, GCIH, GCED), Microsoft SC-200, or equivalent
Who We Are
TD is one of the world's leading global financial institutions and is the fifth largest bank in North America by branches/stores. Every day, we deliver legendary customer experiences to over 27 million households and businesses in Canada, the United States and around the world. More than 95,000 TD colleagues bring their skills, talent, and creativity to the Bank, those we serve, and the economies we support. We are guided by our vision to Be the Better Bank and our purpose to enrich the lives of our customers, communities and colleagues.
TD is deeply committed to being a leader in customer experience, that is why we believe that all colleagues, no matter where they work, are customer facing. As we build our business and deliver on our strategy, we are innovating to enhance the customer experience and build capabilities to shape the future of banking. Through regular leadership and development conversations to mentorship and training programs, we’re here to support you towards your goals. As an organization, we keep growing – and so will you.
Our Total Rewards Package
Our Total Rewards package reflects the investment we make in our colleagues to help them, and their families achieve their well-being goals. Total Rewards at TD includes a base salary and several other key plans such as health and well-being benefits, including medical coverage, paid time off, career development, and reward and recognition programs.
Additional Information
We’re delighted that you’re considering building a career with TD. Through regular development conversations, training programs, and a competitive benefits plan, we’re committed to providing the support our colleagues need to thrive both at work and at home.
Colleague Development
If you’re interested in a specific career path or are looking to build certain skills, we want to help you succeed. You’ll have regular career, development, and performance conversations with your manager, as well as access to an online learning platform and a variety of mentoring programs to help you unlock future opportunities. Whether you have a passion for helping customers and want to expand your experience, or you want to coach and inspire your colleagues, there are many different career paths within our organization at TD – and we’re committed to helping you identify opportunities that support your goals.
Training & Onboarding
We will provide training and onboarding sessions to ensure that you’ve got everything you need to succeed in your new role.
Interview Process
We’ll reach out to candidates of interest to schedule an interview. We do our best to communicate outcomes to all applicants by email or phone call.
Accommodation
If you require an accommodation for the recruitment / interview process (including alternate formats of materials, or accessible meeting rooms or other accommodation), please let us know and we will work with you to meet your needs.
#J-18808-Ljbffr
Associate/AVP, Threat Detection Analyst, COO's Office
Posted today
Job Viewed
Job Description
Press Tab to Move to Skip to Content Link
Select how often (in days) to receive an alert: Create Alert
Associate/AVP, Threat Detection Analyst, COO's Office
Location:
Singapore, SG
Job Function: Chief Operating Officer’s Office
Job Type: Permanent
GIC is one of the world’s largest sovereign wealth funds. With over 2,000 employees across 11 locations around the world, we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the world’s industry leaders. As a leading global long-term investor, we Work at the Point of Impact for Singapore’s financial future, and the communities we invest in worldwide.
Chief Operating Officer (COO) Office
The COO Office supports our COO to streamline operations and align them with strategic goals. You will work with the COO, Heads of Departments, and stakeholders across GIC to achieve operational excellence.
Cyber Security & Resilience
You will be a part of an independent risk management function to protect the firm’s information technology assets, including business data, from external threats and operational risks, and to facilitate the firm’s digitalisation journey in a secure manner.
What impact can you make in this role?
We are looking for an Associate / Assistant Vice President to drive threat detection engineering as part of cybersecurity threat operations for Cyber Security Assurance & Defence (CSAD). You can look forward to a multi-faceted role that will require a wide skillset including business knowledge, technical know-how, execution ability, and strategic and consultative thinking.
What will you do as a Threat Detection Analyst
Operationalize scalable threat detection use cases across GIC’s environment for cyber security defence.
Partner closely with cybersecurity threat operations to ensure threat detection use cases are clearly defined and optimized for security operations
Conduct security and threat research on threat detections
Collaborate with relevant departments to ensure business context are utilized effectively for threat detection.
Develop efficient threat detection use cases that aligns with overall threat detection strategy.
Assist in audit, regulatory and incident reporting matters where relevant.
Keep up to date with industry and technology trends and breaking news that may be relevant to keep GIC secure.
What qualifications or skills should you possess in this role?
At least 5-7 years working in a cyber security operations function or similar.
Good understanding of cybersecurity frameworks, attack techniques (MITRE ATT&CK), and threat detection methodologies.
Working knowledge with different SIEM tools as a power user.
Working knowledge of incident response and malware triage.
Working knowledge of networking and operating systems (Windows / Unix)
Experienced with programming languages, preferably Python, C++/C# or R with experience in AI-related libraries (e.g., TensorFlow, PyTorch, Scikit-learn).
Strong analytical and practitioner skills, combined with good written and verbal communication skills.
Ability to break down and analyze complex problems and articulate them clearly to a non-technical audience.
Relevant certifications in SANS, OffSec or other relevant credentials
Knowledge of cybersecurity threat detection engineering principles and methodologies.
Ability to work independently and as part of a team in a fast-paced, dynamic environment.
Work at the Point of Impact
We need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious, agile, and diverse teams - be empowered to push boundaries and pursue innovative ideas, share your views, and be heard.Be anchored on our PRIME Values: Prudence, Respect, Integrity, Merit and Excellence, which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact.
Flexibility at GIC
At GIC, our offices are vibrant hubs for ideation, professional growth, and interpersonal connection. At the same time, we believe that flexibility allows us to do our best work and be our best selves. Thus, our teams come into the office four days per week to harness the benefits of in-person collaboration, but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise.
GIC is an equal opportunity employer
As an employer, we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.
#J-18808-Ljbffr
Senior Cybersecurity Researcher (Threat Analysis and Detection...
Posted today
Job Viewed
Job Description
Senior Cybersecurity Researcher (Threat Analysis and Detection Engineering)
Please note that the application process will be managed on our partner website, Workday, which will require you to log in or create an account.
Acronis is revolutionizing cyber protection—providing natively integrated, all-in-one solutions that monitor, control, and protect the data that businesses and lives depend on. We are looking for a Senior Cybersecurity Researcher to join our mission to create a #CyberFit future and protect all data, applications and systems across any environment.
As Cybersecurity Researcher, being part of the global Threat Research Unit, you will be fighting against modern cyber threats and cybercriminals by dissecting complex campaigns, reverse engineering malicious content, and creating detection logic for Acronis products. As an expert in cyber threats, you will participate in the development of new threat detection technologies, including various automation and machine learning methods.
What You’ll Do:
Participate in design and implementation of detection capabilities of Acronis Security and EDR products.
Analyse clean and malicious content: executables, scripts, various document formats, websites, memory dumps, vulnerabilities.
Develop, support, and fine-tune threat detection logic and signatures.
Conduct online research of the latest cyber threats and ensure those can be detected by existing in-house technologies.
Contribute to sharing research results in blog posts and articles.
Monitor automated detection pipelines to ensure high detection accuracy.
Support scan engine and product development by participating in joint research projects.
What You Bring (Experience & Qualifications):
Understanding of modern cyber-attack techniques, common types of malware, OS internals (primarily Windows, macOS and Linux is a plus), and network protocols.
5+ years experience in malware analysis (executables, scripts, document formats, exploits): static (e.g. IDA Pro, Ghidra), dynamic (e.g. x64dbg, OllyDBG), and behavioral (e.g. Cuckoo, CAPE).
3+ years experience with proactive Threat Hunting (using multiple EDR/XDR solutions).
Network traffic analysis (Wireshark).
Extensive experience working with threat intelligence tools and services: VirusTotal, Shodan, Censys, MISP (or similar feed collections), analysis with MITRE ATT&CK framework.
3+ years experience working for a well-established security vendor.
Software development experience: Python, REST APIs, SQL, Regular expressions. C/C++ would be considered a plus.
Flexibility and proven ability to learn new things and develop skills fast. Analysis, critical thinking, and problem-solving skills. Unbeatable curiosity.
Good reading and writing skills in English.
WHO WE ARE
Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), enterprise IT departments and home users. Our all-in-one solutions are highly efficient and designed to identify, prevent, detect, respond, remediate, and recover from modern cyberthreats with minimal downtime, ensuring data integrity and business continuity. We offer the most comprehensive security solution on the market for MSPs with our unique ability to meet the needs of diverse and distributed IT environments.
A Swiss company founded in Singapore in 2003, Acronis offers over twenty years of innovation with 15 offices worldwide and more than 1800 employees in 50+ countries. Acronis Cyber Protect is available in 26 languages in 150 countries and is used by over 20,000 service providers to protect over 750,000 businesses.
Our corporate culture is focused on making a positive impact on the lives of each employee and the communities we serve. Mutual trust, respect and belief that we can contribute to the world everyday are the cornerstones of our team. Each member of our “A-Team” plays an instrumental role in driving the success of our innovative and expanding business. We seek individuals who excel in dynamic, global environments and have a never give up attitude, contributing to our collective growth and impact.
Our Interview Practices
To maintain a fair and genuine hiring process, we kindly ask that all candidates participate in interviews without the assistance of AI tools or external prompts. Our interview process is designed to assess your individual skills, experiences, and communication style. We value authenticity and want to ensure we’re getting to know you—not a digital assistant. To help maintain this integrity, we ask to remove virtual backgrounds and include in-person interviews in our hiring process.
Use of AI-generated responses or third-party support during live interviews may be grounds for disqualification from the recruitment process and a full criminal, education and identification background check is required for all new hires.
Acronis is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, color, marital status, national origin, physical or mental disability, medical condition, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, gender identity or expression, or any other characteristic protected by applicable laws, regulations and ordinances.
#L1-WC1
#J-18808-Ljbffr
Incident Response Lead
Posted today
Job Viewed
Job Description
Press Tab to Move to Skip to Content Link
Select how often (in days) to receive an alert: Create Alert
At Tetra Pak we commit to making food safe and available, everywhere; and we protect what's good – protecting food, protecting people, and protecting the planet. By doing so we touch millions of people's lives every day.
And we need people like you to make it happen.
We empower you to reach your potential with opportunities to make an impact to be proud of – for food, people and the planet.
The Incident Response (IR) Lead leads a 24/7 virtual team who monitor and respond to ISIRT major incidents. This role requires management of Incident Response activities and team communication with SOC analysts, SME and other IT technical personnel. This role is also required to work closely with stakeholders and cybersecurity’s leadership team. Additionally, the Incident Response Lead will ensure staff members prioritize their work related to suspected and confirmed incidents, which may vary in severity and impact. The Incident Response Lead will direct analysts to investigate, validate, remediate and communicate known details about the incident and is a point of contact for escalation.
Due to coverage requirements, this is a permanent position based in a country within the Asia time zone.
What you will do
Role and responsibilities:
The Incident Response Lead will analyze and organize to help the team rank complex work. As a central figure, Incident Response Lead brings order to a fast-paced, constantly evolving operation. Incident Response Lead to enforce policies, playbooks and methodologies, which have been adopted for the best course of action.
Personal, organizational, communication and analytical skills are vital, as well as the ability to communicate effectively with cybersecurity leadership. This role requires technical aptitude, and managers are also expected to be adept at working well with people who will be under stress and subject to burnout.
Key Responsibilities:
- Manage a team of incident responders for ISIRT response and interact with cybersecurity leadership and business stakeholders.
- Coordinate and ensure ISIRT incidents are prioritized at all hours of the day.
- Implement a cross-functional team of analysts working closely with cybersecurity, IT and developers.
- Serve as a point of escalation and incident commander.
- Review ISIRT incidents that may be related to ransomware, host compromise, account compromise, phishing, anomalous user behavior, third parties and data leakage.
- Ensure the ISIRT response team is following processes embraced by leadership and adhering to best practices.
- Measure and give feedback to the team to improve mean time to respond, key performance indicators (KPIs) and service-level objectives.
- Proactively adjust to upcoming company changes affecting the operation to modify ISIRT response processes.
- Possess advanced knowledge of attackers’ methods of escalation; lateral movement; and tactics, techniques and procedures.
- Present incident analysis and trend reporting to leadership, highlighting KPIs.
- Review events and process effectiveness and make recommendations for change to leadership.
- Require participation in ISIRT tabletop exercises designed to identify gaps, improve skills, enhance communication and engage with key stakeholders.
- Oversee IR playbooks, policies, procedures and guidelines to ensure they align with industry best practices.
- Collaborate with infrastructure, IT, vulnerability, threat intelligence and application security leads.
- Participate in monitoring internal and external events and stay tightly aligned with infrastructure and third-party, hosted, on-premises and end-user systems.
- Review and communicate ISIRT incident details from initial investigation through root cause analysis and post-mortem.
- Maintain operational rigor and recognize when team members need time away to refocus and refresh.
- Identify strengths and weaknesses in ISIRT team members and provide training to improve skills and knowledge.
- Remain current with emerging threats and share knowledge with colleagues to improve incident response. Perform other duties as assigned.
We believe you have
Strong organizational and team management skills are required to excel in this role, as well as previous experience in security administration, IR and security operations center (SOC) roles.
Seven-plus years’ experience in security administration and SOC, with three-plus years’ security IR.
Demonstrated experience leading people both in person and remotely distributed.
Self-aware and capable of remaining calm under intense pressure.
Strong written and oral communication skills across varying levels of the organization.
Excellent judgment and the ability to make quick decisions when working with complex situations.
Organized, with the ability to prioritize and respond within defined SLAs and maintain composure.
Understanding of threats and vulnerabilities, as well as principles of ISIRT incident response and chain of custody.
Knowledge with multiple solutions such as security orchestration, automation and response; SIEM; threat intelligence platform; directory services; malware sandboxes; vulnerability management; MITRE ATT&CK; IR playbooks; and endpoint/extended detection and response
Generally familiar with one or more but not limited to: NIST, ISO 27001, NIS 2, CRA
Track record of acting with integrity, taking pride in work, seeking to excel, and being curious and flexible.
High degree of integrity, trustworthiness, professionalism and character.
Education Requirements:
Bachelor’s degree preferred in cybersecurity, computer science, engineering or related field.
Certification in CRISC, CISSP, CISA, CISM will be a plus.
We Offer You
A variety of exciting challenges with ample opportunities for development and training in a truly global landscape
A culture that pioneers a spirit of innovation where our industry experts drive visible results
An equal opportunity employment experience that values diversity and inclusion
Market competitive compensation and benefits with flexible working arrangements
Apply Now
If you are inspired to be part of our promise to protect what’s good; for food, people, and the planet, apply through our careers page at .
If you have any questions about your application, please contact
Ephraim Kwa .
Diversity, equity, and inclusion is an everyday part of how we work. We give people a place to belong and support to thrive, an environment where everyone can be comfortable being themselves and has equal opportunities to grow and succeed. We embrace difference, celebrate people for who they are, and for the diversity they bring that helps us better understand and connect with our customers and communities worldwide.
#J-18808-Ljbffr
Be The First To Know
About the latest Threat detection Jobs in Singapore !
Senior Cybersecurity Researcher (Threat Analysis and Detection Engineering)
Posted today
Job Viewed
Job Description
Senior Cybersecurity Researcher (Threat Analysis and Detection Engineering)
2 days ago - Be among the first 25 applicants
Get AI‐powered advice on this job and more exclusive features.
Acronis is revolutionizing cyber protection—providing natively integrated, all‐in‐one solutions that monitor, control, and protect the data that businesses and lives depend on. We are looking for a Senior Cybersecurity Researcher to join our mission to create a #CyberFit future and protect all data, applications and systems across any environment.
As Cybersecurity Researcher, being part of the global Threat Research Unit, you will be fighting against modern cyber threats and cybercriminals by dissecting complex campaigns, reverse engineering malicious content, and creating detection logic for Acronis products. As an expert in cyber threats, you will participate in the development of new threat detection technologies, including various automation and machine learning methods.
What You’ll Do
Participate in design and implementation of detection capabilities of Acronis Security and EDR products.
Analyse clean and malicious content: executables, scripts, various document formats, websites, memory dumps, vulnerabilities.
Develop, support, and fine‐tune threat detection logic and signatures.
Conduct online research of the latest cyber threats and ensure those can be detected by existing in‐house technologies.
Contribute to sharing research results in blog posts and articles.
Monitor automated detection pipelines to ensure high detection accuracy.
Support scan engine and product development by participating in joint research projects.
What You Bring (Experience & Qualifications)
Understanding of modern cyber‐attack techniques, common types of malware, OS internals (primarily Windows, macOS and Linux is a plus), and network protocols.
5+ years experience in malware analysis (executables, scripts, document formats, exploits): static (e.g. IDA Pro, Ghidra), dynamic (e.g. x64dbg, OllyDBG), and behavioral (e.g. Cuckoo, CAPE).
3+ years experience with proactive Threat Hunting (using multiple EDR/XDR solutions).
Network traffic analysis (Wireshark).
Extensive experience working with threat intelligence tools and services: VirusTotal, Shodan, Censys, MISP (or similar feed collections), analysis with MITRE ATT&CK framework.
3+ years experience working for a well‐established security vendor.
Software development experience: Python, REST APIs, SQL, Regular expressions. C/C++ would be considered a plus.
Flexibility and proven ability to learn new things and develop skills fast. Analysis, critical thinking, and problem‐solving skills. Unbeatable curiosity.
Good reading and writing skills in English.
Who We Are
Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), enterprise IT departments and home users. Our all‐in‐one solutions are highly efficient and designed to identify, prevent, detect, respond, remediate, and recover from modern cyberthreats with minimal downtime, ensuring data integrity and business continuity. We offer the most comprehensive security solution on the market for MSPs with our unique ability to meet the needs of diverse and distributed IT environments.
A Swiss company founded in Singapore in 2003, Acronis offers over twenty years of innovation with 15 offices worldwide and more than 1800 employees in 50+ countries. Acronis Cyber Protect is available in 26 languages in 150 countries and is used by over 20,000 service providers to protect over 750,000 businesses.
Our corporate culture is focused on making a positive impact on the lives of each employee and the communities we serve. Mutual trust, respect and belief that we can contribute to the world everyday are the cornerstones of our team. Each member of our “A‐Team” plays an instrumental role in driving the success of our innovative and expanding business. We seek individuals who excel in dynamic, global environments and have a never give up attitude, contributing to our collective growth and impact.
Acronis is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, color, marital status, national origin, physical or mental disability, medical condition, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, gender identity or expression, or any other characteristic protected by applicable laws, regulations and ordinances.
#J-18808-Ljbffr
Business Incident Response Specialist
Posted 3 days ago
Job Viewed
Job Description
The Business Incident Response (BIR) team is a specialized group that provides rapid and holistic resolution of critical escalations that threaten businesses' and partners' brands, relationships, and revenue streams. The team offers dedicated support to advertisers globally who experience friction on our platforms.By leveraging cross-functional partnerships, the BIR team delivers an immediate and personalized experience for constituents and stakeholders during times of crisis. The team operates off-process and overrides barriers to ensure swift issue resolution, prioritizing resources dynamically to assume ownership over mission-critical incidents.The escalations handled by the BIR team are complex and require experience in areas such as operations, policy, process, and project management. The team comprises best-in-class specialists who leverage their skills to deliver outsized impact.To succeed on the BIR team, candidates should be passionate about social media, real-time crisis management, and working collaboratively in a fast-paced environment. Candidates should have a high level of interest in customer support and working cross-functionally with multiple domains, including policy and process. Candidates will have to navigate ambiguity and have the capacity to make quality decisions while remaining unbiased and open to feedback. Candidates will be communicating relevant content and context to inform and enable internal and external partners, including executive level communication.The role will be based in Singapore.
**Required Skills:**
Business Incident Response Specialist Responsibilities:
1. Review, investigate and coordinate the end-to-end resolution of executive-level incidents in adherence with the respective process and policy frameworks
2. Communicate effectively with multiple stakeholders, including external clients, internal partners and the leadership group
3. Serve as the primary communication channel on critical escalations
4. Cooperate with a wide group of cross-functional partners across the business, including those outside of your domain expertise, to coordinate the work and develop long-lasting relationships
5. Successfully execute assigned tasks and/or project work, ensuring that goals are met within scope and timelines
6. Join and/or organize group meetings to effectively discuss, and occasionally present, on many business matters including core work, projects, and strategy
7. Perform root-cause analysis and/or draft post-mortem reports to identify areas of opportunity and issue recommendations to the appropriate audience
8. Drive innovation by contributing towards resolving problem statements and proposing improvements to existing processes
9. Attend mandatory training and seek knowledge in areas of interest to the business
10. Be an expert on interpreting and enforcing Meta's policies and use sound judgment, specific knowledge, signals and insights to drive scalable solutions to support Meta and our users
11. Adopt best practices in order to achieve individual and collective goals
**Minimum Qualifications:**
Minimum Qualifications:
12. 5+ years of experience working in large-scale operations, domains such as online operations, escalations, informational systems, compliance, risk management, policy, legal operations, management consulting or related fields
13. Demonstrated understanding of how the broader social media landscape operates in the industry
14. Demonstrated experience thinking strategically about complex issues leading to thoughtful recommendations, and making quality decisions when dealing with ambiguous situations
15. Demonstrated experience navigating ambiguous situations
16. Experienced working within fast-paced environments, handling multiple workstreams and maintaining effective communication with all stakeholders, both internal and external
**Preferred Qualifications:**
Preferred Qualifications:
17. Experience with analytical tools (i.e. Excel, SQL, Tableau) and influencing others leveraging data and analysis
18. Familiarity with Meta's suite of products
19. Proficiency in another language spoken in Asia Pacific (business fluent)
20. Experience working directly with global, cross-functional teams to solve issues and develop solutions
21. Understanding of the power of social media for businesses and the issues that are inherent to it
22. Degree in Science, Technology, Engineering, and Mathematics (S.T.E.M)
**Industry:** Internet
Principal Consultant, Incident Response
Posted 6 days ago
Job Viewed
Job Description
At Palo Alto Networks® everything starts and ends with our mission:
Being the cybersecurity partner of choice, protecting our digital way of life.
Our vision is a world where each day is safer and more secure than the one before. We are a company built on the foundation of challenging and disrupting the way things are done, and we're looking for innovators who are as committed to shaping the future of cybersecurity as we are.
**Who We Are**
We take our mission of protecting the digital way of life seriously. We are relentless in protecting our customers and we believe that the unique ideas of every member of our team contributes to our collective success. Our values were crowdsourced by employees and are brought to life through each of us everyday - from disruptive innovation and collaboration, to execution. From showing up for each other with integrity to creating an environment where we all feel included.
As a member of our team, you will be shaping the future of cybersecurity. We work fast, value ongoing learning, and we respect each employee as a unique individual. Knowing we all have different needs, our development and personal wellbeing programs are designed to give you choice in how you are supported. This includes our FLEXBenefits wellbeing spending account with over 1,000 eligible items selected by employees, our mental and financial health resources, and our personalized learning opportunities - just to name a few!
At Palo Alto Networks, we believe in the power of collaboration and value in-person interactions. This is why our employees generally work full time from our office with flexibility offered where needed. This setup fosters casual conversations, problem-solving, and trusted relationships. Our goal is to create an environment where we all win with precision.
**Your Career**
As a Principal Consultant in Unit 42 the individual will be responsible for managing incident response engagements with our largest clients and in our most complex engagements. They will become the go-to expert for clients during high-priority incident response, remediation, and recovery phases, providing both strategic guidance and technical oversight, while also focusing on product integration. The role requires in-depth cybersecurity expertise to enable serving as an incident commander throughout the incident response lifecycle.
While actively involved in incident response service delivery, this person also works with peers and the executive team to enhance Unit 42's incident response practice, including developing and improving the technical and operating methodologies employed during incident response engagements.
We are seeking an individual who is dedicated to delivering highly technical consulting services to an exceptional standard, thrives in a fast paced team environment, and advocates for innovative approaches to deliver the best outcomes for our cross-sector clients.
**Your Impact**
+ Lead the team delivering high-profile, high-stakes enterprise level incident response engagements
+ Provide hands-on, expert-level incident response services to clients and deliver findings to CxO and/or Board of Directors
+ Partner with the Unit 42 Directors, executive team and service line leaders to develop and execute strategy for the Unit 42 Digital Forensics & Incident Response (DFIR) practice, as well as continuously advance the maturity of our services
+ Drive innovation in Unit 42's reactive offerings, by leading the consulting team and collaborating with cross-functional teams to bring new capabilities and services to market that leverage Palo Alto Networks products
+ Ensure the consistency and quality of our services and highest level of customer service
+ Integrate threat intelligence into our services by deepening the feedback loop with Unit 42 Threat Intelligence team and telemetry
+ Recruit and onboard world class Incident Response talent to support our growth goals
+ Support the professional growth and development of our consultants through training and technical enablement
+ Foster and maintain a culture that attracts and retains smart, kind team members dedicated to executing with excellence
+ Identify and execute strategies for service development, enablement, and process that result in the pull through of Palo Alto Networks products
+ Cultivate and maintain relationships with key clientele to increase awareness of Unit 42's' capabilities and provide on-demand expertise for client needs
+ Amplify Unit 42s' presence and credibility in the marketplace through thought leadership, including via speaking engagements, articles, whitepapers, and media exposure
**Your Experience**
+ 6 years of hands-on professional experience in incident response, with 3 years experience in client-facing consulting roles.
+ Demonstrated prior experience and success in leading multi-site, large scale incident response engagements, including scoping work, managing incident response engagements end-to-end and providing guidance on tactical and longer term remediation recommendations
+ Experience in managing, leading and motivating consultants at all levels
+ Experience as a team leader including overseeing other senior, and mid-level analyst/consultant teams
+ Ability to travel as needed to meet business demands
+ Able to split your time across commercial support, client delivery, team coaching, and technical expertise and skills maintenance activities.
+ Strong presentation, communication, and presentation skills with verifiable industry experience communicating at CxO and/or Board of Directors level
+ Expert level of knowledge of applicable laws, compliance regulations, and industry standards as it relates to privacy, security, and compliance
+ Deep technical experience and operational understanding of major operating systems (Microsoft Windows, Linux, or Mac) and/or proficiency in host based forensics, network forensics and cloud incident response.
+ Endpoint Detection and Response (EDR), threat hunting, log analysis,and triage forensics
+ Collection and analysis of host and cloud based forensic data at scale.
+ Client services mindset and top-notch client management skills
+ Experienced-based understanding of clients' needs and desired outcomes in incident response investigations
+ Demonstrated writing ability, including technical reports, business communication, and thought leadership pieces
+ Operates with a hands-on approach to service delivery with a bias towards collaboration and teamwork
+ Track record of championing innovation and improvement initiatives for your area of expertise, identifying emerging trends and technologies and developing leading solutions to address client needs.
+ Be a valuable contributor to the practice and, specifically develop an external presence via public speaking, conferences, and/or publications
+ Have credibility, executive presence, and gravitas
+ Able to have a meaningful and rapid delivery contribution
+ Have the potential and capacity to understand all aspects of the business and an excellent understanding of PANW products
+ Be collaborative and able to build relationships internally, externally, and across all PANW functions, including the sales team
+ Bachelor's Degree in Information Security, Computer Science, Digital Forensics, Cyber Security, or equivalent years of professional experience or equivalent relevant experience or equivalent military experience required to meet job requirements and expectations.
+ Professional industry certifications such as: GIAC Certified Forensic Analyst (GCFA), GIAC Certified Forensic Examiner (GCFE), GIAC Incident Handler (GCIH)
**The Team**
Unit 42 Consulting is Palo Alto Network's security advisory team. Our vision is to create a more secure digital world by providing the highest quality incident response, risk management, and digital forensic services to clients of all sizes. Our team is composed of recognized experts and incident responders with deep technical expertise and experience in investigations, data breach response, digital forensics, and information security. With a highly successful track record of delivering mission-critical cybersecurity solutions, we are experienced in working quickly to provide an effective incident response, attack readiness, and remediation plans with a focus on providing long-term support to improve our clients' security posture.
**Our Commitment**
We're problem solvers that take risks and challenge cybersecurity's status quo. It's simple: we can't accomplish our mission without diverse teams innovating, together.
We are committed to providing reasonable accommodations for all qualified individuals with a disability. If you require assistance or accommodation due to a disability or special need, please contact us at .
Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace, and all qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or other legally protected characteristics.
All your information will be kept confidential according to EEO guidelines.