Cyber Incident Response & Digital Forensics Lead

SITA Group; Singapore; Hybrid; SGD 90,000 - 140,000; Full time

Benefits offered by this job

Flex Week

Flex Day

Flex-Location

Employee Wellbeing

Professional Development

Competitive Benefits

Job summary

SITA is seeking a proactive Digital Forensics & Incident Response (DFIR) Specialist to investigate cybersecurity incidents, perform digital forensics, and support containment across our global environment. You will work with Security Operations, CSIRT Threat, Cloud & Infrastructure, and Product Security to determine root causes and impact.

Ideal candidates bring hands-on DFIR experience, strong analytical skills, and proficiency in Python/PowerShell, with knowledge of MITRE ATT&CK.

Qualifications

• Experience in digital forensics, incident response, or cyber investigations within enterprise environments.
• Hands-on experience with EDR/XDR, SIEM, forensic investigation, and security monitoring tools.
• Experience analysing security incidents across endpoints, servers, cloud environments, networks, and identity platforms.
• Proficiency in Python and/or PowerShell, with working knowledge of KQL or similar query languages.
• Understanding of MITRE ATT&CK framework and TTPs.

Responsibilities

• Investigate security incidents across the full incident response lifecycle including containment and recovery.
• Coordinate incident response activities with SOC, CSIRT Threat, and other stakeholders.
• Contribute to incident reports, technical findings, and remediation recommendations.
• Develop scripts and automation to support evidence collection and analysis.
• Maintain forensic readiness and improve incident response processes.

Skills

Digital Forensics

Incident Response

Cyber Investigations

EDR/XDR

SIEM

Python/PowerShell

KQL

MITRE ATT&CK

Analytical Skills

Documentation

Tools

FTK

EnCase

Velociraptor

KAPE

Autopsy

Volatility

Job description

SITA is seeking a proactive Digital Forensics & Incident Response (DFIR) Specialist to investigate cybersecurity incidents, perform digital forensics, and support containment across our global environment. You will work with Security Operations, CSIRT Threat, Cloud & Infrastructure, and Product Security to determine root causes and impact.

Ideal candidates bring hands-on DFIR experience, strong analytical skills, and proficiency in Python/PowerShell, with knowledge of MITRE ATT&CK.