Digitial Forensic Incident Responder, Threat Intelligence & Repsonse Division

IMDA; Singapore; On-site; SGD 110,000 - 180,000; Full time

Job summary

IMDA's Connectivity, Cybersecurity & Resilience Group seeks an experienced cybersecurity incident investigator to join its Singapore team. You will lead investigations from containment to closure, leveraging log analysis, digital forensics, and threat assessment to guide response actions.

The role requires 5+ years in incident investigations or digital forensics, with GIAC certifications highly preferred, and hands-on experience with common forensic tools.

Qualifications

• 5+ years of experience in cybersecurity incident investigations or digital forensics.
• GIAC GCFA/ GREM/ GCFE/ GCIH certifications are highly regarded.
• Experience in Security Operations Centre (SOC) is advantageous.
• Strong analytical mindset and excellent communication with stakeholders.

Responsibilities

• Collaborate with team members to ensure smooth daily operations and prioritisation of tasks.
• Investigate cybersecurity incidents to determine root cause using logs, forensics, and malware analyses.
• Provide guidance on mitigations, threat detection rules, and attack techniques observed.
• Prepare incident reports and present briefings to stakeholders with risk, impact and replies to inquiries.
• Maintain incident response playbooks and stay updated on cybersecurity trends and TTPs.

Skills

Incident response

Digital forensics

Threat analysis

Communication skills

Education

Background in Information Security/CS/Engineering

Tools

Magnet AXIOM

Encase

X-Ways

FTK

Autopsy

Job description

What the role is

This role sits within the Connectivity, Cybersecurity & Resilience Group (C2R) Group. C2R strengthens the cybersecurity and resilience posture of the telecommunication and media sectors in Singapore. The Group keeps Singapore’s digital connectivity secure, trusted, and robust against an evolving and increasingly complex threat landscape.

What you will be working on

• Work with team members to ensure smooth daily operations and tasks prioritisation and collaborate with stakeholders to ensure timely response to cybersecurity incidents from containment till closure.
• Investigate cybersecurity incidents to determine root cause, involving log and digital forensic analysis or malware analysis, and assess cybersecurity threats, vulnerabilities and exploits to provide strong technical guidance to investigation and threat assessments.
• Recommend preventive actions and mitigations against techniques used in incidents, as well as threat detection rules and signatures (e.g., Snort, Yara, Sigma) against cyber incidents or campaigns.
• Prepare and review incident reports to update stakeholders, and present incident briefings including attack techniques and malware behaviours observed, risk, impact, and address enquiries from various stakeholders.
• Review and update incident response playbooks, maintain processes, and uphold situational awareness by keeping current with cybersecurity trends, threats, and attacker Tactics, Techniques and Procedures (TTPs).

What we are looking for

• Background in Information Security, Computer Science, Engineering or equivalent
• 5 years or more of related work experience in cybersecurity incident investigations or digital forensics.
• Relevant professional certifications including GIAC GCFA, GREM, GCFE, or GCIH are highly regarded.
• Proficiency in forensic toolkits such as Magnet AXIOM, Encase, X-Ways, FTK, or Autopsy.
• Experience working in a Security Operation Centre (SOC) is advantageous.
• Strong analytical mindset with keen attention to detail, and good communication and interpersonal skills to engage effectively with diverse stakeholders.
• A growth mindset with a willingness to learn and stay ahead of the evolving cybersecurity landscape.