Detection Engineer/Cyber Incident Responder (SOC)

Amaris Consulting | Part of Mantu; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Amaris Consulting is seeking an experienced Detection Engineer & Incident Responder to join our Cybersecurity practice in Singapore. You will design and build detection logic, lead investigations, and support 24/7 SOC operations across the region.

You will drive use-case development, threat hunting, incident response, and cross-functional collaboration with regional and global stakeholders to mature the detection posture and risk mitigations.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or related field.
• 7+ years of cybersecurity experience, including incident response and security operations.
• 4+ years specifically in security use case design, development, and detection content coding.
• Working knowledge of Java for use case/detection logic development.
• Hands-on experience with a SIEM platform (Elastic/ELK, Splunk, QRadar, Sentinel, or ArcSight).

Responsibilities

• Lead the definition, design, implementation, and enrichment of security use cases mapped to the MITRE ATT&CK framework.
• Research emerging threats and translate them into detection logic to detect, protect, or mitigate.
• Tune and refine detection content to reduce false positives and improve fidelity.

Skills

Incident response

Security operations

Use case design

Detection content coding

Java

SIEM

MITRE ATT&CK

Linux

Threat hunting

Incident investigations

Education

Bachelor’s degree in Cybersecurity/CS/IT/Engineering

Tools

Elastic/ELK

Splunk

QRadar

Sentinel

ArcSight

Job description

ABOUT THE JOB

We are looking for an experienced

Job Description

We are looking for an experienced Detection Engineer & Incident Responder to join our Cybersecurity practice in Singapore, supporting a client's regional Security Operations function. This role sits at the intersection of security use case development, threat detection, and incident response — you will design and build detection logic based on real-world attack scenarios, respond to security incidents, and help mature the detection posture of a 24/7 SOC. This is a hands‑on technical role for someone who thinks like both a defender and a builder — you'll be writing detection content, hunting for threats, and leading investigations, not just monitoring dashboards.

Detection Engineering & Use Case Development

• Lead the definition, design, implementation, and continuous enrichment of security use cases, mapped to the MITRE ATT&CK framework
• Research emerging threats in the wild and translate them into new detection logic to detect, protect, or mitigate
• Tune and refine existing detection content to reduce false positives and improve fidelity

Incident Response & Threat Hunting

• Respond to cybersecurity and IT security incidents, assessing type, severity, and impact
• Lead investigations from triage through root cause analysis, containment, and remediation
• Conduct proactive threat hunting using IOC and TTP analysis
• Track incidents through to closure, coordinating with technical stakeholders

SOC Capability & Process Improvement

• Oversee and enhance detection capabilities supporting a 24/7 regional SOC
• Identify recurring security issues and risks; develop mitigation plans and process improvements
• Review and refine SOC policies, playbooks, and operational procedures
• Partner with regional and global stakeholders to ensure detection and response readiness

Reporting & Compliance

• Document and report incidents in line with the client's incident management framework
• Contribute to control frameworks, audits, and regulatory compliance activities as required

About You

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or related field
• 7+ years of overall cybersecurity experience, including incident response and security operations
• 4+ years specifically in security use case design, development, and detection content coding
• Working knowledge of Java (or similar language) for use case/detection logic development
• Hands‑on experience with a SIEM platform (Elastic/ELK, Splunk, QRadar, Sentinel, or ArcSight)
• Solid understanding of MITRE ATT&CK and adversary TTPs
• Working knowledge of Linux (RedHat/Ubuntu) and core security concepts (TCP/IP, authentication, Windows Event IDs, Kerberos)
• Proven experience investigating, remediating, and closing security incidents with cross‑functional stakeholders
• Comfortable working with large datasets — collection, analysis, and automation of detection content

Preferred Qualifications

• Experience with ELK (Elastic, Logstash, Kibana) specifically
• Scripting/automation skills: Python, PowerShell, Bash, SQL
• Industry certifications: SANS, CISSP, OSCP (or equivalent)
• French language proficiency is a plus

Soft Skills

• Strong problem‑solving ability and comfort working autonomously
• Clear communicator, able to explain technical findings to varied stakeholders
• Proactive, self‑directed, and able to multitask under deadlines
• Team player with strong interpersonal skills

WHY AMARIS?

• An international community bringing together 110+ different nationalities
• An environment where trust has a central place: 70% of our key leaders started their careers at the first level of responsibilities
• A robust training system with our internal Academy and 250+ available modules
• A vibrant workplace that frequently gathers for internal events (afterworks, team buildings, etc.)
• At Mantu, sustainability is part of everything we do. You’ll have the opportunity to turn your ideas into action and make a tangible impact. Every day, our teams bring our ESG commitments to life, from reducing our footprint to driving positive change within our communities. Through our WeCare Together program, you’ll be empowered to design and lead projects that create real social or environmental impact, with the company’s full support.

Amaris Consulting is proud to be an equal‑opportunity workplace. We are committed to promoting diversity within the workforce and creating an inclusive working environment. For this purpose, we welcome applications from all qualified candidates regardless of gender, sexual orientation, race, ethnicity, beliefs, age, marital status, disability, or other characteristics.

Who are we?

Amaris Consulting is an independent technology consulting firm providing guidance and solutions to businesses. With more than 1,000 clients across the globe, we have been rolling out solutions in major projects for over a decade – this is made possible by an international team of 7,600 people spread across 5 continents and more than 60 countries. Our solutions focus on four different Business Lines: Information System & Digital, Telecom, Life Sciences and Engineering. We’re focused on building and nurturing a top talent community where all our team members can achieve their full potential. Amaris is your steppingstone to cross rivers of change, meet challenges and achieve all your projects with success.

At Amaris, we strive to provide our candidates with the best possible recruitment experience. We like to get to know our candidates, challenge them, and be able to give them proper feedback as quickly as possible. Here's what our recruitment process looks like:

• Brief Call: Our process typically begins with a brief virtual/phone conversation to get to know you! The objective? Learn about you, understand your motivations, and make sure we have the right job for you!
• Interviews (the average number of interviews is 3 - the number may vary depending on the level of seniority required for the position). During the interviews, you will meet people from our team: your line manager of course, but also other people related to your future role. We will talk in depth about you, your experience, and skills, but also about the position and what will be expected of you. Of course, you will also get to know Amaris: our culture, our roots, our teams, and your career opportunities!
• Case study: Depending on the position, we may ask you to take a test. This could be a role play, a technical assessment, a problem‑solving scenario, etc.
• As you know, every person is different and so is every role in a company. That is why we have to adapt accordingly, and the process may differ slightly at times. However, please know that we always put ourselves in the candidate's shoes to ensure they have the best possible experience.

We look forward to meeting you!