Analyst, Threat Detection and Response

SATS Ltd.; Singapore; On-site; SGD 65,000 - 90,000; Full time

Job summary

SATS Ltd. is seeking a Threat Detection and Response Analyst to support alert triage, detection, incident response, and threat hunting across a global organization with teams in North America, EMEA, and APAC.

The role emphasizes building foundational expertise under senior guidance in incident lifecycles with a strong IT/networking background. The successful candidate will collaborate with global colleagues, tune detections, and contribute to playbooks and knowledge bases while advancing through

Qualifications

• Bachelor’s degree or equivalent practical IT/security experience.
• 2–3 years in threat detection, incident response or threat hunting.
• Certifications such as Security+, Network+, A+ are a plus; pursuit expected.
• Experience with SIEM/EDR, logs analysis, and incident lifecycle.
• Exposure to cloud environment security and basic scripting is preferred.

Responsibilities

• Investigate security alerts, triage scope and severity, escalate when needed.
• Support root-cause analysis, identify attack vectors and affected systems.
• Execute defined incident response steps: containment, evidence preservation, eradication support.
• Coordinate with IT stakeholders to support response and remediation.
• conduct threat hunting across global, distributed tech environment.
• Hunt for IOCs in logs, traffic, and endpoints; refine playbooks.
• Assist in tuning SIEM/EDR rules and automate repetitive actions.
• Stay current on vulnerabilities and attacker techniques relevant to investigations.
• Collaborate with global TDR team; joint investigations and knowledge sharing.
• Document steps, findings, and actions; contribute to incident reports and reviews.
• Help develop and update incident response playbooks and SOPs.

Skills

Threat Detection

Incident Response

Threat Hunting

Cyber Threat Intelligence

Network Security

Log Analysis

Automation

Scripting (Python/PowerShell)

Education

Bachelor’s degree in Cybersecurity/CS/IS or equivalent

Tools

SIEM

EDR

IDS/IPS

Cloud platforms (AWS/Azure/GCP)

Job description

The Role

This position serves as a threat detection and response analyst with day to day focus on alert triage, detection, incident response, and threat hunting. The role supports a global organization with team members in North America, EMEA, and APAC regions.

Job Description

Key Responsibilities

The Role

This position serves as a threat detection and response analyst with day to day focus on alert triage, detection, incident response, and threat hunting. The role supports a global organization with team members in North America, EMEA, and APAC regions.

This role is designed for an analyst building foundational expertise in threat detection and incident response. The successful candidate will work under the guidance of senior team members, develop proficiency across the incident lifecycle, and progressively take on more complex investigations as their skillset grows. A strong foundation in IT, networking, or systems administration is ideal.

Key Responsibilities

• Investigate security alerts and events, triage to determine scope and severity, and expedite to senior analysts when appropriate
• Support root cause analysis under senior analyst guidance, helping identify attack vectors and affected systems
• Execute defined incident response actions under guidance, including initial containment steps, evidence preservation, and supporting eradication and recovery efforts
• Coordinate with IT stakeholders, as directed, to support response actions and threat remediation
• Participate in threat hunting operations across a global, distributed technology environment
• Hunt for indicators of compromise and suspicious activity in logs, network traffic, and endpoint telemetry, using help refine hunting procedures and playbooks
• Assist with tuning SIEM/EDR detection rules and thresholds, and help identify opportunities to automate repetitive response actions
• Stay current on new vulnerabilities and adversary tactics relevant to ongoing investigations
• Work closely with global TDR team members and collaborate with colleagues in other regions (e.g. joint investigations or hand‑offs) to ensure seamless coverage and knowledge sharing
• Document investigation steps, findings, and actions taken for each incident in a clear and concise manner, and contribute to incident reports and post-incident review meetings
• Assist in developing and updating incident response playbooks, standard operating procedures, and knowledge base documentation.

Key Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or equivalent practical experience in IT or security operations
• Certifications such as Security+, Network+, A+ or equivalent are a plus; willingness to pursue certifications is expected
• 2-3 years of experience in one or more or the following disciplines:
  • Threat Detection & Analysis (leveraging SIEM tools, IDS/IPS, endpoint detection, log analysis, etc.)
  • Incident Response & Management (developing response plans, executing playbooks, forensic investigations, root cause analysis)
  • Threat Hunting (identifying undetected threats through proactive analysis and hypothesis-driven investigation)
  • Cyber Threat Intelligence (gathering and analyzing threat intelligence to inform detection capabilities and preventive measures)
  • Network Security (TCP/IP protocols, firewalls, intrusion prevention systems, and network traffic analysis)
  • Exposure to securing and monitoring operating system and cloud environments (AWS, Azure, GCP), including reviewing cloud service logs and configurations for suspicious activity
• Demonstrated ability to:
  • Function as a Level 1 or Level 2 Analyst (triaging and responding to cybersecurity alerts and incidents)
• Preferred Experience:
  • Experience with automation tools and some proficiency in shell scripting languages (e.g., Python, PowerShell) to automate repetitive tasks and streamline investigations