Cybersecurity SOC Manager

NETS; Singapore; On-site; SGD 120,000 - 240,000; Full time

Job summary

NETS is seeking an accomplished cybersecurity leader to drive incident response, digital forensics, and SOC operations. The role requires leading high-stakes investigations across endpoints, networks, cloud, and identity, while coordinating with Legal, Risk, and IT teams.

The candidate will develop IR playbooks, mentor analysts, and implement automation to accelerate responses. Strong communication with senior stakeholders is essential for crisis situations and regulatory reporting.

Qualifications

• 10–15+ years in cybersecurity with a focus on incident response.
• 5+ years in incident response / digital forensics / SOC operations
• 3+ years in a lead or incident management capacity
• Hands-on experience in incident response methodologies and frameworks
• Familiarity with MITRE ATT&CK framework and malware behavior
• Experience in crisis management and cross-functional coordination during high-pressure incidents

Responsibilities

• Lead end-to-end incident response across detection, triage, containment, eradication and recovery.
• Analyze malware, attacker behaviors, and intrusion patterns to determine root cause and scope.
• Act as Incident Commander during major security incidents with cross-functional teams.
• Drive structured incident management processes and adherence to SLAs.
• Serve as the highest technical escalation point within SOC for complex investigations.
• Develop and maintain incident response playbooks and runbooks.
• Drive automation and SOAR tooling to accelerate response actions.
• Liaise with Fraud, Risk, Compliance, IT and regulators as needed.

Skills

Incident response leadership

Crisis management

Communication & stakeholder management

Structured thinking

Mentorship & team leadership

Threat hunting

Tools

EDR/XDR platforms

SIEM platforms

Job description

Key Responsibilities

Incident Response & Investigation

• Lead and conduct end-to-end incident response across detection, triage, containment, eradication, and recovery.
• Able to perform deep technical investigations across endpoints, network, identity, cloud, and application layers.
• Analyze malware, attacker behaviors, and intrusion patterns to determine root cause and attack scope.
• Handle high-severity and sophisticated cyber incidents, including APT, ransomware, and fraud-related attacks.
• Maintain detailed documentation of incidents, actions taken, and lessons learned.

Security Incident Management

• Act as Incident Commander during major security incidents, coordinating cross-functional teams (SOC, IR, IT, Legal, Risk, Communications).
• Drive structured incident management processes, ensuring adherence to SLAs and playbooks.
• Provide timely and clear communications to senior management and stakeholders.
• Lead post-incident reviews (PIRs) and ensure remediation actions are tracked to closure.

SOC Operations & Escalation

• Serve as the highest technical escalation point within SOC for complex investigations.
• Support SOC analysts in triage and response for high-priority alerts.
• Improve escalation processes and decision-making frameworks during incidents.

Playbooks, Processes & Readiness

• Develop, maintain, and continuously improve incident response playbooks and runbooks.
• Ensure readiness for various threat scenarios including ransomware, data exfiltration, and insider threats.
• Conduct and support tabletop exercises and incident simulations.
• Align incident response processes with industry frameworks (e.g., MAS TRMG, CCoP, NIST, ISO 27035).

Threat Intelligence & Detection Feedback Loop

• Leverage threat intelligence to enhance incident response effectiveness.
• Provide feedback to detection engineering and threat hunting teams to improve use cases and monitoring coverage.
• Identify detection gaps exposed during incidents and drive remediation.

Digital Forensics & Evidence Handling

• Perform or oversee forensic data acquisition and analysis (disk, memory, logs).
• Ensure proper chain of custody and evidence handling for legal and regulatory needs.
• Support investigations that may require regulatory reporting or legal actions.

Automation & Tooling

• Drive the use of automation and SOAR playbooks to accelerate response actions.
• Recommend and implement tools to improve investigation speed and accuracy.

Stakeholder & Regulatory Engagement

Liaise with internal stakeholders including Fraud, Risk, Compliance, and IT.

Support regulatory incident reporting requirements relevant to financial/payment systems.

Act as a trusted advisor during cyber crisis situations.

Required Qualifications & Experience

10–15+ years of cybersecurity experience, with:

• 5+ years in incident response / digital forensics / SOC operations
• 3+ years in a lead or incident management capacity

Strong hands-on experience in:

• Incident response methodologies and frameworks
• EDR/XDR platforms
• SIEM platforms
• Network and endpoint investigation techniques

Deep understanding of:

• Threat actor tactics, techniques, and procedures (TTPs)
• MITRE ATT&CK framework
• Malware behavior and attack lifecycle

Experience in:

• Crisis management and incident command
• Cross-functional coordination during high-pressure scenarios

Strong technical skills in:

• OS internals (Windows/Linux)
• Networking (TCP/IP, DNS, HTTP/S, etc.)
• Log analysis and correlation

Preferred Qualifications

Experience in financial services, payments, or critical infrastructure environments

Hands-on malware analysis and reverse engineering (basic to advanced)

Familiarity with:

• Cloud security incident response (AWS, Azure, GCP)
• Identity-based attacks and investigations
• Exposure to fraud-related cybersecurity incidents

Preferred Certifications

• GIAC certifications (GCFA, GCIH, GNFA, GREM)
• CISSP, CISM
• Certified Incident Handler / Forensics certifications
• Vendor certifications (Microsoft, CrowdStrike, Google Mandiant, Elastic, etc.)

Key Competencies

• Strong technical depth and investigative skills
• Ability to lead during high-pressure incidents
• Excellent communication and stakeholder management
• Structured and analytical thinking
• Decisiveness and accountability
• Mentorship and team leadership

What Success Looks Like

• Rapid and effective containment of high-impact security incidents
• Reduced MTTR (Mean Time to Respond) and improved response quality
• Well-executed and coordinated incident management processes
• Continuous improvement of IR playbooks and readiness
• Strong trust and confidence from executive leadership and stakeholders