Correlation & Automation Lead

Ensign InfoSecurity; Singapore; On-site; SGD 60,000 - 80,000; Full time

Job summary

A leading cybersecurity firm in Singapore is seeking an experienced professional to manage and improve security monitoring use cases. The ideal candidate has over 3 years in a SOC environment, expertise in SIEM, and strong analytical skills. Responsibilities include the creation and maintenance of correlation rules, analyzing security events, and ensuring effective monitoring processes. Certifications such as Splunk and SANS are advantageous. Join a dynamic team to enhance security operations.

Qualifications

• 3+ years of experience in security operations within a SOC environment.
• 2+ years of experience with correlation rules and SIEM dashboards.
• Familiarity with Regex and/or scripting.
• Strong problem-solving and analytical skills.

Responsibilities

• Implement and maintain security monitoring use cases.
• Create and fine-tune SIEM data sources and alerts.
• Analyze security events and network traffic.

Skills

Security operations expertise

SIEM knowledge

Regex and scripting

Critical thinking

Analytical skills

Stakeholder management

Attention to detail

Education

Splunk Enterprise Certified Administrator

SANS certification (GCDA, GCIA, GDSA, GMON)

Job description

Ensign is hiring !

Key Responsibilities

• Perform implementation, maintenance, support and operation of the project's security monitoring use cases
• Maintain understanding of the architecture and work with security team to understand the use cases to be created.
• Identity, evaluate and recommend new areas of improvements for the implementation.
• Adhere to established change management process and other service management process in day-to-day tasks
• Create, finetune and maintain SIEM data sources, use cases, correlation rules and security alerts classifications
• Review, propose and generate dashboards and reports to automate monitoring of systems and log and threat intelligence feed ingestion, and reduce low value event escalations
• Build rules and intelligence to detect threats in all monitored assets
• Implement and devise detection method of such threats in our security operations through SIEM use cases etc
• Perform periodic analysis of security events, network traffic, and logs to engineer new detection methods, or create efficiencies when available
• Review and update data enrichment, including use of threat intelligence to enhance fidelity of detection
• Review and maintain UEBA data sources and use cases

Requirements

• At least 3 years of experience in security operations in a SOC environment
• At least 2 years of experience in creating, finetuning and maintaining correlation rules and SIEM dashboards
• Working experience in Regex and / or scripting
• Strong critical thinking / contextual analysis abilities
• Strong investigative and analytical problem solving skillsStakeholder management
• Meticulous with an eye for details
• Product certification such as Splunk Enterprise Certified Administrator or equivalent
• Professional certification such as SANS (such as SANS GCDA, GCIA, GDSA, GMON) would be an advantage
• Good understanding of whole of government environment would be an advantage