AI Cyber Defence Specialist

RED ALPHA CYBERSECURITY PTE. LTD.; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

RED ALPHA CYBERSECURITY PTE. LTD. seeks an AI Cyber Defence Specialist to lead threat management across SOC, vulnerability management, threat hunting and DFIR. You will drive AI-enabled detection, incident response and post-incident reviews, coordinating with MSSP/MDR partners and internal teams.

The role requires 5+ years in cybersecurity with hands-on SOC, IR and DFIR experience, including leadership. Strong knowledge of SIEM/EDR/XDR, SOAR and vulnerability management is essential.

Qualifications

• A degree in Computer Science, Information Technology, Cybersecurity or related discipline.
• At least 5 years of cybersecurity experience with hands-on SOC, incident response and DFIR, including 3+ years leading a team.
• Proven track record leading significant incidents from detection to recovery and post-incident review.
• Hands-on expertise with SIEM, EDR/XDR and SOAR platforms.
• Experience with vulnerability management platforms and risk-based prioritisation.
• Strong analytical skills, ability to work under pressure and manage incidents on-call.

Responsibilities

• Lead and manage 24x7 SOC operations, including MSSP/MDR partnerships, ensuring events are monitored, triaged, escalated and resolved within SLAs.
• Own the SOC operating model, playbooks, runbooks, escalation matrix, and drive improvements using AI.
• Drive detection engineering across SIEM/EDR/XDR and map use-cases to MITRE ATT&CK to increase coverage and reduce false positives.
• Ensure log source coverage across endpoints, servers and networks.
• Oversee SOAR automation for alert enrichment, triage and containment actions.
• Define and report SOC KPIs/KRIs to CISO and senior management.
• Lead response to critical zero-days and emerging vulnerabilities with rapid assessment and patching coordination.
• Establish threat-hunting programmes based on threat intelligence and MITRE ATT&CK.

Skills

SOC operations

Incident response

Digital forensics

Threat hunting

SIEM

EDR/XDR

SOAR

Vulnerability management

AI/LLM security

Education

Bachelor's degree in CS/IT/Cybersecurity

Tools

Elastic SIEM

Microsoft Sentinel

Google Cloud SecOps

QRadar

Job description

We are seeking anArtificial Intelligence (AI)Cyber Defence Specialistto lead the organisation’s threat management capabilities across Security Operations, Vulnerability Management, Threat Hunting and Digital Forensics & Incident Response (DFIR)byleveragingonAI.

Reporting to the CISO Office, the candidate will be accountableand responsibilityfor the roles asstatedbelow. The candidate will ensure these capabilities are intelligence-ledusing AI, measurable and aligned to regulatory and industry expectations, including(but not limited)tothe Cybersecurity ActandCybersecurity Code ofPractice(CCoP).

Roles and Responsibilities of this role includethe use of AI,but are not limited to:

• Leadandmanagethe24x7Security Operations Centre (SOC)operations, including any ManagedSecurityServiceProvider (MSSP) or MDR partner, ensuringsecurity events aremonitored, triaged, escalated and resolved withindefinedService Level Agreements (SLAs).

• Own the SOC operating modeland its associatedprocess– tiered analyst structure, shift roster, playbooks,runbooksand escalation matrix – and drive measurable improvement in SOC maturityusing AI.

• Drive detection engineering across SIEM, EDR/XDR,identityand cloud-nativesecurity tooling; develop,tuneand retire usecases mapped toMITRE ATT&CK to increasedetection coverage and reduce falsepositives.

• Ensure log source coverage across critical assets – endpoints,serversandnetwork

• Oversee SOAR automation to accelerate alert enrichment,triageand containment actions.

• Define and report SOC KPIs and KRIs (e.g. MTTD, MTTR, ATT&CK coverage, alertseverity, SLA adherence) to the CISO andsenior management.

• Leadthe organisation’s responseto critical zero-day and emergingvulnerabilities, including rapid exposure assessment, compensatingcontrolsand emergency patching coordination.

• Establish andleada structured, hypothesis-driventhreat huntingprogramme basedonthreatintelligence,MITRE ATT&CK and anomaliesobservedin environment telemetry.

• Develop hypotheses and techniques,and execute hunts toidentifyundetectedthreats across the environment; convert hunt findings into new or improved detections.

• Gather and analysecyberthreatinformation and intelligence from commercial feeds, government sources (e.g. CSA /Sectorallead)and open sources to derive insights on attack tactics, techniques andprocedures (TTPs),campaignsandthreatactorprofiles relevant to the organisation and itssector.

• Operationalisethreatintelligence, including IOC ingestion and management of thethreatintelligence platform (TIP).

• Act assecurityincidentresponderforcyberincidents, coordinating technical response, containment, eradication and recovery across internal teams and external partners.

• Manage vendor relationships,contractsand performance for MSSP/MDR, IR retainer, maintenance forcybersecurity technology stack,security toolingproviders; plan and manage thecyberdefence budget.

• Present the organisation’sthreatlandscape,incidenttrendsandcyberdefence posture to the CISO.

• Support internal and external audits and regulatory inspections, providing evidence of control design and operating effectiveness.

• Proactively coordinate with technical and businessstakeholders, andmanage internal and external partnerships during asecurityincident.

• Anyotherassigned dutieswhen there is a change in the business requirements and scope of work.

What you need to have:

• A degree in Computer Science, Information Technology,Cybersecurityor a related discipline.

• At least5years of cybersecurity experience, with substantial hands-on experience in SOC operations, incidentresponseand digital forensics, including at least 3 years leading a team.

• Proventrack recordof leading the response to significant incidents (e.g. ransomware, targeted intrusions, data breaches) from detection through to recovery and post-incident review.

• Hands-onexpertisewith SIEM (e.g.Elastic, Microsoft Sentinel, Google SecOps,QRadar), EDR/XDR (e.g. CrowdStrike, Microsoft Defender,Trendmicro,Trellix),andSOAR platforms.

• Experience with vulnerability management platforms (e.g. TenableNessus) and risk-based prioritisation approaches.

• Highly analytical, with strong attention to detail and outstanding problem-solving skills; able to work independently and under pressure in a fast-paced environment.

• Willingness to be on call and respond outside office hours during major incidentsand/or as and when the need arises.

• Relevantcybersecurity certifications.

• Strong knowledge of frameworks and regulations such as MITRE ATT&CK, CIS Controls v8.1, ISO/IEC 27001:2022,Cybersecurity Act and PDPA.

• Familiarity with AI-enabled security operations and threats targeting AI/LLM workloads.