Engineer, Cybersecurity Threat Detection

ICE DATA SERVICES SINGAPORE PTE. LTD.; Singapore; Presencial; SGD 90.000 - 150.000; Jornada completa

Descripción de la vacante

ICE Data Services Singapore Pte. Ltd. seeks a cybersecurity threat detection engineer to design, tune, and maintain detections across SIEM, EDR, and NDR platforms, while mapping coverage to MITRE ATT&CK and aligning with threat intelligence. The role emphasizes proactive hunting and reducing false positives within a globally distributed infrastructure.

You will implement detection logic, build internal tooling, and collaborate with security operations to strengthen coverage and telemetry health.

Formación

• 3+ years of experience in threat detection, security operations, or threat hunting.
• Hands-on experience with SIEM, EDR, and NDR platforms and writing/tuning detection logic.
• Proficient in a scripting language for automation to build internal tooling.
• Ability to investigate suspicious activity end to end from logs to conclusions.
• Familiarity with MITRE ATT&CK and reasoning about adversary tradecraft.
• Solid understanding of OS internals, networking, and authentication as seen in security telemetry.

Responsabilidades

• Design, build, test, and maintain detection content across SIEM, EDR, and NDR platforms.
• Own false positives, alert volume, and rule health for detection areas.
• Map detection coverage to MITRE ATT&CK; identify gaps and propose telemetry to close them.
• Convert threat intelligence into prioritized detection and hunting work.
• Develop and execute focused threat hunts; produce durable production detections.
• Take ownership of red team gap remediation and validate post-retest coverage.
• Validate log source health and onboard/update SIEM sources as needed.
• Apply a developer mindset to create internal tooling and automate repeat tasks.

Conocimientos

Threat detection

Security operations

Scripting

Investigating logs

MITRE ATT&CK knowledge

OS internals

Networking

Authentication

Educación

University degree in Engineering, MIS, CIS

Herramientas

SIEM

EDR

NDR

Splunk

Elasticsearch

Tanium

CrowdStrike

SentinelOne

Descripción del empleo

Job Purpose

The ICE Cybersecurity Threat Detection team is responsible for detecting malicious behavior across ICE's global infrastructure quickly and reliably enough to contain it. We build, tune, and maintain the detection content that security operation teams depend on, and hunt proactively for threats that existing controls do not catch, working alongside threat intelligence, incident response, and red team functions to keep coverage grounded in real adversary behavior.

Responsibilities

• Detection Engineering - Design, build, test, and maintain detection content across SIEM, EDR, and NDR platforms, and document the intent, data source, and expected behavior of each detection
• Detection Tuning and Health - Own false positive rates, alert volume, and rule health for assigned detection areas, including retiring logic that no longer earns its place
• Detection Coverage - Map detection coverage to the MITRE ATT&CK framework, identify gaps, and propose the telemetry or logic needed to close them
• Threat Intelligence Integration - Convert threat intelligence reporting into prioritized detection and hunting work, so coverage follows the adversaries and techniques most relevant to the sector rather than whatever arrived most recently
• Proactive Threat Hunting - Develop and execute focused hunts to discover threats that evade existing controls, and promote successful hunt outcomes into durable production detections
• Red Team Gap Remediation - Take ownership of detection gaps reported through red team and purple team exercises; track each gap to closure, build or amend the detection, and validate that the exercise activity is caught on retest
• Log Source Health - Validate the health and completeness of security log sources, detect collection failures and silent feeds, and onboard or update SIEM log sources in a timely manner
• Automation and Tooling - Apply a developer and problem-solving mindset to the work, using scripting to build internal tooling, process and normalize data, and remove repetitive manual effort wherever it appears

Knowledge and Experience

• University degree in Engineering, MIS, CIS, or related discipline; or equivalent years of experience
• 3+ years of relevant experience in threat detection, security operations, or threat hunting
• Hands on, day to day experience with SIEM, EDR, and NDR platforms, including writing and tuning detection logic
• Working knowledge of a scripting language for automation, at the level needed to build useful internal tooling
• Demonstrated ability to investigate suspicious activity end to end: read the logs, form a conclusion, and communicate it clearly
• Familiarity with the MITRE ATT&CK framework and the ability to reason about adversary tradecraft rather than only indicators
• Solid understanding of operating system internals, networking, and authentication as they appear in security telemetry

Preferred Experience

• Authoring Sigma rules and working with portable, vendor neutral detection formats
• Detection as code practices, including Git workflows, peer reviewed rule changes, automated rule testing, and pipeline based deployment
• Structured hunting methodologies such as PEAK or TaHiTI, and experience hunting against a documented backlog rather than ad hoc
• Applied AI engineering in a security context, including use or development of LLM assisted tooling for triage, enrichment, rule drafting, or log summarization, together with a realistic understanding of where these systems fail and how to evaluate their output
• Malware analysis, digital forensics, or reverse engineering fundamentals

Specific Technologies

SIEM platforms including Splunk and Elasticsearch. Endpoint detection and response platforms including Tanium, CrowdStrike, and SentinelOne. Network detection and response tooling and network traffic analysis. MITRE ATT&CK. Scripting and automation in Python or PowerShell. Windows, Linux, and cloud security telemetry, including authentication, process execution, and network log formats. Version control and ticketing workflows.