Cyber Incident Responder (Python / ELK / Java / SIEM)

Maltem Asia-Pacific; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Maltem SG is seeking a Cyber Incident Responder for our Banking domain client. You will lead technical activities in IT Production Security Investigation & Incident Response, defining use cases, design and enrichment to strengthen detection across layers.

You will autonomously perform threat hunting, investigate incidents, and coordinate with stakeholders to drive incident closure. English is a must; French is a plus.

Qualifications

• 7+ years in cybersecurity incident response.
• Experience designing and developing security use cases; coding skills.
• Knowledge of Linux (RedHat/Ubuntu).
• Experience with SIEM and incident management processes.
• Threat hunting and incident investigation experience.
• Scripting skills in Python/PowerShell/Bash/SQL is a plus.

Responsibilities

• Lead security usecase definition, design, implementation and enrichment for detection across layers.
• Understand threats in the wild and propose usecases to detect, protect or mitigate.
• Autonomously perform technical activities in IT Production Security Investigation & Incident Response.
• Oversee detection capabilities of the 24/5 regional IT Production SOC.
• Respond to cyber/IT security incidents and evaluate event type and severity.

Skills

Security incident response

Use case design

Java

Linux

Threat modeling

SIEM

Incident management

Threat hunting

Scripting (Python/PowerShell/Bash/SQL)

Tools

ELK stack

Job description

Maltem SG is currently seeking a Cyber Incident Responder for our Banking domain Client.

Summary:

• Lead technical activities (security usecase definition, design, implementation & enrichment) in the team of IT Production Security Investigation & Incident Response based on real-world attack scenarios and framework like MITRE ATT&CK, ensuring robust security detection posture across various layers.
• Understand ongoing security threats in the wild and propose security usecase to detect and when possible, protect or mitigate.
• Be autonomous on technical activities (definition, R&D/threat hunting) in the team of IT Production Security Investigation & Incident Response and oversee the detection capabilities of the 24/5 regional IT Production SOC
• Respond to Cyber / IT security incidents and evaluates the type and severity of security events.

Technical Skills

• Requires a minimum of 7 or more years of experience as security professional
• Experience in security usecase design/development with understanding of Java language.
• Good working knowledge of Linux (RedHat/Ubuntu).
• Working knowledge to interpret security logs or instructions into threat models. SecOPS-DevOPS mindset & skills.
• Experience and knowledge in investigating incidents, remediation, tracking and follow-up for incident closure with concerned teams, stakeholders.
• Thorough understanding of technologies and security concepts, with knowledge & hands on experience in SIEM Product and Security Incident Management
• Experience on incident response activities (threat hunting, event analysis, incident investigation, reporting)
• Comfortable working with and making the most of large data sets (collection, analysis, response), creating content/use cases/models and bringing an automation mindset. Personal Attributes
• Strong problem-solving skills Good communication skills (English is MUST, French is added advantage)
• Positive attitude, willing to upskill and carry out in-depth troubleshooting
• Has the ability to work autonomously and think on feet, be-proactive.
• Good interpersonal skills and team player
• High energy level coupled with a desire to take on responsibility
• Able to multi-task & deliver within agreed deadlines.

Must have:

• Candidate MUST have 7 or more years of experience on overall cybersecurity incident response with 4+ years specifically on security usecase design, development, coding.
• Experience in SIEM on ELK(Elastic Logstash Kibana) stack is a plus
• Professional credentials in one of the relevant IT Security disciplines is a plus (SANS / CISSP / OSCP)
• Experience in common scripting languages such as Python, PowerShell, Bash, SQL is a plus