Cloud Incident Response Leader (VP) - Automation & Defense

Citi; Singapore; On-site; SGD 180,000 - 320,000; Full time

Job summary

Citi is seeking a Cloud Incident Responder (VP) to lead incident response across AWS, GCP, Snowflake, and Databricks. You will architect playbooks, run advanced investigations, and drive automation while coordinating with global teams to protect Citi's critical assets.

You will shape security processes, document outcomes thoroughly, and participate in threat modeling and purple team exercises. A strong blend of cloud security expertise and leadership is essential.

Qualifications

• 6-10 years of cloud security, cybersecurity or incident response experience.
• Hands-on security expertise in AWS and GCP.
• Experience with SaaS/PaaS security and data platforms like Snowflake and Databricks.
• Strong problem-solving and documentation skills.
• Experience with log aggregation and security analytics tools (e.g., Splunk, Sentinel, Chronicle).
• Ability to work independently with minimal oversight.

Responsibilities

• Lead response automation and incident playbooks for cloud environments.
• Conduct cloud-focused investigations using logs and telemetry.
• Coordinate automated workflows for forensic artifact collection.
• Oversee cloud-native containment across compromised environments.
• Perform proactive threat hunting using host-based and cloud-native analyses.
• Collaborate with stakeholders to influence security architecture decisions.
• Document incidents in detail for continuous improvement.
• Participate in threat modeling and tabletop exercises.

Skills

Cloud Security

Incident Response

AWS

GCP

Snowflake

Databricks

Automation

Threat Hunting

Forensic Analysis

Documentation

Communication

Education

Bachelor's degree

Master's degree preferred

Tools

Splunk

Microsoft Sentinel

Chronicle

Databricks Security

Job description

Citi is seeking a Cloud Incident Responder (VP) to lead incident response across AWS, GCP, Snowflake, and Databricks. You will architect playbooks, run advanced investigations, and drive automation while coordinating with global teams to protect Citi's critical assets.

You will shape security processes, document outcomes thoroughly, and participate in threat modeling and purple team exercises. A strong blend of cloud security expertise and leadership is essential.