Cyber Defense Center, Lead Analyst, AVP

state street bank and trust company; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

State Street Bank and Trust Company seeks a Lead Cyber Security Operations Center (SOC) analyst to drive detection, triage, analysis, and response to cyber-attacks. This role operates in a 24/7 Fusion Center environment with a partner team in Singapore and will work on-site in State Street's Singapore office.

You will lead incident response, produce leadership reports, develop playbooks, and mentor SOC staff while collaborating with teams across the Fusion Center to strengthen security posture.

Qualifications

• Experience investigating and managing major/complex cyber incidents end to end.
• Experience working/leading in a SOC or Fusion Center.
• Strong OS administration skills (Windows, Linux, Mac).
• Security technologies: SIEM, EDR, AV, ID/PS, HIPS, proxies, AD, PKI, DNS.

Responsibilities

• Lead the cyber incident response process for high severity incidents and ensure timely containment and recovery.
• Author incident status updates and closure reports to leadership.
• Produce postmortem reports with lessons learned and recommendations.
• Maintain and update incident response plans, playbooks, and procedures.

Skills

Incident response leadership

SOC operations

Memory forensics

Adversarial TTPs knowledge

OS administration (Windows/Linux/Mac)

Threat hunting

Scripting (Python)

Education

Master's in Cyber Security/IT/CS

CISSP/CEH/OSCP/OSCE/GCIH or equivalent

Tools

SIEM

EDR/EPP

AV

ID/PS

HIPS

Web Proxy/Content Filtering

Active Directory (AD)

PKI

DNS

Python

PowerShell

SQL

Job description

Who are we looking for:

State Street seeks to recruit a Lead Cyber Security Operations Center (SOC) analyst that will assist in the detection, triage, analysis and response to cyber-attacks. The analyst will join our SOC team which will run a 24/7 coverage, 365 days a year model, with a partner team in Singapore.

The SOC team is responsible for analyzing events from multiple sources across a large enterprise network. The SOC will partner with multiple teams in our Cyber Fusion Center including but not limited to Advanced Threat, Cyber Threat Intelligence, & Red/Purple teams.

Join us in evolving our response capabilities to protect State Street, its customers and partners from ever evolving and sophisticated threat actors. State Street’s Fusion Center is responsible for detecting and responding to various cyber threats 24/7 365 days a year, that are directed towards the enterprise.

This role will be Monday - Friday and will be on-site in State Street's office in Singapore.

What will you be responsible for:

• Leading the cyber incident response process to ensure timely triage, analysis, containment, eradication, and return to service for high severity or long running incidents.
• Author incident status updates and closure reports to leadership.
• Produce postmortem reports to identify lessons learned and recommendations.
• Continuously prepare for incidents by updating and maintaining incident response plans, playbooks and procedures.
• Manage and participate in cyber related exercises such as tabletops and cyber ranges.
• Measure the effectiveness and performance of the incident response process through KRI and KPI metrics.
• Identify methods to continuously enhance the incident response process
• Work closely with the SOC to drive development and collaboration
• Train and Mentor SOC personnel
• Creating an environment which drives knowledge sharing with teams across the Fusion Center
• Help developing the Fusion Center mindset and follow the sun model

What we value:

• Experience with investigating & managing major/complex cyber incidents end to end
• Experience working/leading in a SOC or Fusion Center
• Strong operating systems administration skills (Windows, Linux, Mac)
• Strong malware analysis expertise
• Experience in performing memory forensics
• Knowledge of adversarial tactics, techniques, procedures (TTPs) & Industry standard frameworks (NIST, Mitre Att&ck)
• Knowledge of IT architecture and operations (computing, network, storage & cloud)
• Strong working knowledge of security technologies including but not limited to SIEM, EDR/EPP, AV, ID/PS, HIPS, Web Proxy/Content filtering, AD, PKI and DNS
• Master's in cyber security, Information Technology, Computer Science or relevant experience
• CISSP, CEH, OSCP, OSCE or GCIH or applicable certification in Security field
• 4+ years in cyber security SOC/IR type skill role – Incident Response, SOC Tier 3/Lead Analyst, Threat Hunter, Penetration testing, etc.
• Financial Services experience a plus.
• Software development and/or scripting experience a plus: Python, Powershell, SQL etc.