Cyber Security Defensive Analyst

SAGL Consulting; Singapore; On-site; SGD 70,000 - 90,000; Full time

Job summary

A cybersecurity consulting firm in Singapore is seeking a Cyber Security Defensive Analyst to detect and respond to advanced threats. Key responsibilities include threat hunting, developing detection use cases, and mentoring junior analysts. Strong experience in Threat Hunting and Threat Intelligence, along with SIEM and EDR knowledge, is essential. Proficiency in English is required, and basic Mandarin is a plus. Competitive compensation and a collaborative work environment are offered.

Qualifications

• Strong hands-on experience in Threat Hunting and Threat Intelligence.
• Proficient with SIEM (Splunk ES) and EDR (CrowdStrike).
• Strong understanding of attack lifecycle, common attack vectors, tools, and techniques.
• Ability to analyze large data sets.
• Excellent report writing and communication skills in English.
• Basic understanding of Mandarin is preferred.

Responsibilities

• Conduct threat hunting across endpoint and network data.
• Develop and maintain detection/prevention use cases in SIEM and EDR.
• Perform triage and technical analysis of alerts.
• Leverage threat intelligence feeds to enrich investigations.
• Provide clear reports and updates to stakeholders during incidents.
• Mentor junior analysts.

Skills

Threat Hunting

Threat Intelligence

SIEM (Splunk ES)

EDR (CrowdStrike)

Report writing

Communication skills

Tools

Splunk ES

CrowdStrike

Job description

We are looking for a Cyber Security Defensive Analyst with strong expertise in Threat Hunting and Threat Intelligence. You will be responsible for detecting, analyzing, and responding to advanced threats using SIEM and EDR tools, while supporting incident response and proactive defense operations. This role is part of a 24/7 global cyber defense function and requires strong technical, analytical, and communication skills.

Key Responsibilities:

• Conduct threat hunting across endpoint and network data to identify anomalies, IOAs, and TTPs.
• Develop and maintain detection/prevention use cases in SIEM (Splunk ES) and EDR (CrowdStrike).
• Perform triage and technical analysis of alerts, determining scope and remediation actions.
• Leverage threat intelligence feeds (OSINT and premium sources) to enrich investigations.
• Provide clear reports and updates to stakeholders during incidents.
• Mentor junior analysts in threat hunting and incident response practices.

Requirements (Must-Have):

• Strong hands‑on experience in Threat Hunting and Threat Intelligence (endpoint + network).
• Proficient with SIEM (Splunk ES) and EDR (CrowdStrike).
• Strong understanding of attack lifecycle, common attack vectors, tools, and techniques.
• Ability to analyze large data sets to detect anomalies, IOAs, and TTPs.
• Excellent report writing and communication skills (English).
• Basic understanding of Mandarin is preferred but not mandatory (to support stakeholders in the region).

Good to Have:

• Experience with AI/ML in threat hunting.
• Exposure to OT/ICS and Cloud security environments.
• Experience with threat intelligence platforms and premium intel feeds.
• Relevant certifications (CISSP, GCIH, or similar).