Cybersecurity Operations Team Lead – ATFM Security Managed Support (Day 2 Operations)

LANTU EMPLOYMENT AGENCY PTE. LTD.; Singapore; On-site; SGD 75,000 - 95,000; Full time

Job summary

A staffing agency in Singapore is seeking a Security Team Lead to oversee a three-person team ensuring the operational efficiency and security of ATFM systems. The role involves managing technical oversight, stakeholder engagement, and continuous improvement initiatives. The ideal candidate should have strong knowledge of security tools and at least 2 years in a leadership role. This position also requires readiness to respond to high-priority incidents outside standard working hours.

Qualifications

• Strong working knowledge of SIEM, PAM, EDR, and endpoint protection tools.
• Proven ability to lead technical teams in a 24/7 environment.
• At least 2 years in a leadership role.

Responsibilities

• Lead and manage the Day 2 Operations team.
• Oversee execution of account and log reviews.
• Serve as the central point of contact with multiple stakeholders.
• Consolidate team inputs for monthly operational reports.
• Identify process gaps and recommend improvements.

Skills

SIEM (Splunk)

PAM (CyberArk)

EDR (VMware Carbon Black)

Endpoint protection (Trellix)

Decision-making

Conflict resolution

Job description

Role Purpose

The ATFM Security Team Lead is responsible for leading a three-person team in the ongoing support and protection of ATFM systems. The role ensures operational efficiency, technical excellence, and compliance with established security standards. The Team Lead will act as the primary liaison between the ATFM security team, higher management, internal technical teams, and external security partners.

Key Responsibilities

1. Leadership & Coordination

• Lead and manage the Day 2 Operations team, including scheduling, workload assignment, and performance monitoring.
• Act as the primary escalation point for operational, technical, and stakeholder issues.

2. Technical Oversight

• Oversee the execution of regular account and log reviews using Splunk, CyberArk, Trellix, Carbon Black, and other security tools.
• Provide guidance on incident investigation, root cause analysis, and remediation tracking.
• Ensure all security alerts and incidents are handled according to established SLAs.

3. Stakeholder Engagement

• Serve as the central point of contact with HTSOC, GSOC, FM Teams (System, Cloud, Network), and tenants (Application).
• Facilitate remediation follow-up, risk register maintenance, and VAPT action closure.
• Work closely with the external CISO on compliance initiatives, policy enforcement, and audit readiness.

4. Reporting & Governance

• Consolidate and review team inputs for monthly operational reports.
• Provide ad-hoc reports and security status updates to management as required.
• Track KPIs and SLAs to ensure service quality and compliance.

5. Continuous Improvement

• Identify process gaps and recommend enhancements to improve operational efficiency and security posture.
• Mentor and upskill engineers to maintain high technical competency across all required tools

Be available and must be able to respond to high-priority incidents outside standard working hours as part of standby duty

Required Skills & Experience

Technical Skills:

• Strong working knowledge of SIEM (Splunk), PAM (CyberArk), EDR (VMware Carbon Black), and endpoint protection (Trellix).
• Understanding of security incident lifecycle, vulnerability management, and compliance frameworks.

Leadership Skills:

• Proven ability to lead technical teams in a 24/7 standby environment.
• Strong decision-making, prioritisation, and conflict-resolution skills.

Experience:

• At least 2 years in a leadership role.
• Experience coordinating with multiple stakeholders across different technical and business domains.