Cyber Incident Responder (Python / ELK / Java / SIEM)

Maltem Asia-Pacific; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Maltem SG is seeking a Cyber Incident Responder for our Banking domain Client. The role leads technical activities in IT Production Security Investigation & Incident Response, applying MITRE ATT&CK to ensure robust detection across layers.

You will investigate ongoing threats, design security use-cases, and oversee SOC detection capabilities for a 24/7 regional operation. English fluency is required; French is a plus.

Qualifications

• 7+ years in cybersecurity incident response
• 4+ years in security use-case design/development/coding
• ELK stack experience is a plus
• IT security credentials (SANS/CISSP/OSCP) a plus
• Python/PowerShell/Bash/SQL scripting is a plus

Responsibilities

• Lead technical activities in IT Production Security Investigation & Incident Response based on MITRE ATT&CK across multiple layers.
• Understand threats and propose security use-cases to detect and mitigate.
• Autonomously perform technical activities (R&D/threat hunting) and oversee the 24/7 regional SOC detection capabilities.
• Respond to cyber/IT security incidents and evaluate the type and severity of events.

Skills

Incident response

Threat hunting

Security use-case design

English communication

Tools

ELK Stack

SIEM

Linux

Scripting (Python/Bash/PowerShell)

Job description

Maltem SG is currently seeking a Cyber Incident Responder for our Banking domain Client.

Summary:

• Lead technical activities (security usecase definition, design, implementation & enrichment) in the team of IT Production Security Investigation & Incident Response based on real-world attack scenarios and framework like MITRE ATT&CK, ensuring robust security detection posture across various layers.
• Understand ongoing security threats in the wild and propose security usecase to detect and when possible, protect or mitigate.
• Be autonomous on technical activities (definition, R&D/threat hunting) in the team of IT Production Security Investigation & Incident Response and oversee the detection capabilities of the 24/7 regional IT Production SOC
• Respond to Cyber / IT security incidents and evaluates the type and severity of security events.

Technical Skills

• Requires a minimum of 7 or more years of experience as security professional
• Experience in security usecase design/development with understanding of Java language.
• Good working knowledge of Linux (RedHat/Ubuntu).
• Working knowledge to interpret security logs or instructions into threat models. SecOPS-DevOPS mindset & skills.
• Experience and knowledge in investigating incidents, remediation, tracking and follow-up for incident closure with concerned teams, stakeholders.
• Thorough understanding of technologies and security concepts, with knowledge & hands on experience in SIEM Product and Security Incident Management
• Experience on incident response activities (threat hunting, event analysis, incident investigation, reporting)
• Comfortable working with and making the most of large data sets (collection, analysis, response), creating content/use cases/models and bringing an automation mindset. Personal Attributes
• Strong problem-solving skills Good communication skills (English is MUST, French is added advantage)
• Positive attitude, willing to upskill and carry out in-depth troubleshooting
• Has the ability to work autonomously and think on feet, be-proactive.
• Good interpersonal skills and team player
• High energy level coupled with a desire to take on responsibility
• Able to multi-task & deliver within agreed deadlines.

Must have:

• Candidate MUST have 7 or more years of experience on overall cybersecurity incident response with 4+ years specifically on security usecase design, development, coding.
• Experience in SIEM on ELK(Elastic Logstash Kibana) stack is a plus
• Professional credentials in one of the relevant IT Security disciplines is a plus (SANS / CISSP / OSCP)
• Experience in common scripting languages such as Python, PowerShell, Bash, SQL is a plus