CTI Analyst

ENCORA TECHNOLOGIES PTE. LTD.; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

ENCORA TECHNOLOGIES PTE. LTD. seeks an experienced Threat Hunter to proactively identify threats across endpoints, networks and cloud.

You will develop hypotheses, leverage MITRE ATT&CK and other frameworks, and automate hunting processes while collaborating with incident response and vulnerability teams to strengthen defense. Strong CTI skills and certifications are preferred.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, or related field.
• 10+ years in cybersecurity with at least 8 years in threat intelligence.
• Strong knowledge of Windows, Linux and macOS.
• Experience with security tools and technologies (SIEM, EDR, network monitoring).
• Ability to translate findings to business impact and present clearly.
• Experience with CTI platforms, feeds and CTI frameworks.
• Relevant security certifications (e.g., CISSP, CISA, Security+).

Responsibilities

• Lead threat hunting and analysis across endpoints, networks and cloud.
• Develop hypotheses using MITRE ATT&CK, PEAK, TAHITI, THMM and Diamond Model.
• Build and automate threat hunting workflows and scripts.
• Investigate security incidents and provide root-cause analyses and remediation guidance.
• Develop Cyber Threat Intelligence and share with internal and external stakeholders.
• Collaborate with incident response and vulnerability teams to coordinate defense.
• Contribute to continuous improvement of SOC playbooks and processes.

Skills

Analytical skills

Communication skills

Presentation skills

Problem-solving skills

OS knowledge

Education

Bachelor's degree in Computer Science

Tools

SIEM

EDR

Network monitoring tools

YARA rules

IOC analysis

Job description

Main Responsibilities

Threat Hunting and Analysis

• Conduct proactive threat hunting activities across various environments(endpoints, networks, cloud).
• Develop and maintain threat hunting hypotheses based on current threatintelligence and organizational risk assessments.
• Apply structured threat hunting methodologies leveraging frameworks such as MITRE ATT&CK, PEAK, TAHITI, THMM and Diamond Model to guide hypothesis creation, evidence collection and iterative improvements.
• Deep technical knowledge of adversary tactics, malware analysis, intrusion detection and cloud security.

Tooling and Automation

• Familiar with EDR/XDR solutions, SIEM platform, data pipeline and threat hunting tooling to detect and disrupt adversary tactics.
• Develop custom scripts and tools to automate threat hunting processes and improve efficiency.
• Leverage various threat hunting techniques, including but not limited to, YARA rules, IOC analysis, and behavioral based analysis.

Incident Investigation

• Analyze security logs, network traffic, and endpoint data to identify malicious activity and potential threats.
• Investigate security incidents and provide detailed reports on findings, including root cause analysis and remediation recommendations.
• Collaborate with other security teams (incident response, vulnerability management, etc.) to share threat intelligence and coordinate security efforts.

Cyber Threat Intelligence (CTI)

• Develop and manage Cyber Threat Intelligence while staying up to date on the latest threat landscape, attack techniques, and emerging technologies.
• Map advisory behaviors to ATT&CK techniques and translate findings into actionable intelligence.
• Share actionable intelligence with internal teams and external stakeholders.
• Present findings and recommendations to technical and executive audiences.

Continuous Improvement

• Contributes to the development and improvement of threat hunting strategies, processes and playbooks aligning with PEAK and TAHITI cycles for structural threat hunting.
• Develop and maintain a strong understanding of the organization's infrastructure and applications to strengthen awareness of evolving threats and adversary behavior.
• Drive maturing of the overall security operations service.

Qualifications & Skills: Required

• Bachelor's degree in Computer Science, Cybersecurity, or a related field.
• At least 10 years of experience in cybersecurity, with a minimum of 8 yearsfocused on threat intelligence
• Strong understanding of various operating systems (Windows, Linux, macOS).
• Experience with various security tools and technologies (SIEM, EDR, network monitoring tools).
• Strong analytical and problem-solving skills.
• Excellent communication and presentation skills to translate technical findings into business impact.
• Experience with threat intelligence platforms, feeds and CTI frameworks.
• Relevant security certifications (e.g., CISSP, CISA, Security+)