L3 Threat Hunting and Intel (Sans Cert/ SIEM) #IFL

RECRUIT EXPRESS PTE LTD; Singapore; On-site; SGD 70,000 - 100,000; Full time

Job summary

A dynamic cybersecurity firm in Singapore seeks an experienced Detection Engineer to develop and execute high-fidelity detection strategies using advanced tools. The role involves leading incident responses, threat hunting, and mentoring junior analysts to enhance overall security posture. Ideal candidates will possess significant expertise in detection engineering, exhibit strong problem-solving skills, and be familiar with frameworks like MITRE ATT&CK.

Qualifications

• Proven experience in detection engineering, incident response, and threat hunting.
• Knowledge of SIEM tools and frameworks like MITRE ATT&CK.
• Experience in mentoring and leading teams.

Responsibilities

• Design and optimize detection rules across security platforms.
• Lead incident response lifecycle and handle escalated incidents.
• Mentor L1/L2 SOC analysts and participate in team training.

Skills

Detection Engineering

Incident Response

Threat Hunting

Forensic Analysis

MITRE ATT&CK Framework

Job description

Detection Engineering

• Design, develop, and deploy high-fidelity detection rules in SIEM (Splunk, Microsoft Sentinel, Devo, QRadar, EDR, etc.).
• Create custom use cases to detect MITRE TTPs aligned with real-world threats and red team activities.
• Conduct detection gap analysis, tune alerting mechanisms, and eliminate false positives at the MSS customer environment
• Perform regular fine-tuning and optimization of detection rules, correlation logic, and alert thresholds across SIEM, EDR, and other security platforms to enhance detection accuracy and reduce false positives.
• Continuously assess detection efficacy based on incident feedback and threat landscape evolution, implementing improvements accordingly.
• Collaborate with red/purple teams to validate detection logic and build threat-informed defenses.
• Regularly review, update, and enhance detection logic to ensure alignment with the latest threat intelligence, adversary TTPs, and evolving attack techniques.
• Maintain relevancy and effectiveness of security detections by incorporating insights from threat hunts, incident response cases, red team exercises, and industry best practices.

Threat Hunting and Threat Intel:

• Proactively hunt for advanced threats across on-prem and cloud environments using telemetry from SIEM, EDR, NDR, and threat intelligence.
• Develop hypotheses based on TTPs, threat intelligence feeds, and incident trends.
• Use frameworks like MITRE ATT&CK and Diamond Model to structure hunting campaigns.
• Document hunt procedures and outcomes to support knowledge sharing and continuous improvement.
• Map threat actor TTPs to frameworks such as MITRE ATT&CK to support proactive defense strategies and inform detection engineering efforts.
• Provide actionable threat intelligence to SOC, detection engineering, and IR teams to inform custom detection rule development, prioritization of hunts, and incident scoping
• Contribute to the threat intelligence lifecycle, including direction, collection, processing, analysis, dissemination, and feedback.
• Ingest, analyze, and operationalize threat intelligence from internal sources, commercial feeds, and open-source intelligence (OSINT) to enrich detection logic, threat hunting hypotheses, and incident investigations
• Collaborate with internal and commercial threat intelligence teams to contextualize IOCs and TTPs for targeted and industry-specific threats.
• Maintain up-to-date threat intelligence repositories and contribute to the continuous improvement of threat intel processes and playbooks

Incident Response:

• Lead incident response lifecycle (detection, triage, containment, eradication, recovery).
• Handle security incidents tickets escalated by Level II team, and draft security incident report covering the root cause, forensic evidence, and recommended mitigation plans
• Conduct/support forensic analysis of endpoints, logs, and network traffic to determine root cause and impact.
• Coordinate with internal stakeholders and external partners during critical incidents.
• Develop and maintain playbooks, runbooks, and incident reports.
• Digital Forensics and Incident Response (DFIR) experience is a strong added advantage, enabling deeper investigations and root cause analysis.

Collaboration & Mentorship :

• Mentor and support L1/L2 SOC analysts in investigations, tool usage, and processes.
• Participate in tabletop exercises and red/purple team assessments.
• Lead and conduct regular customer meetings to review SOC activities, including security posture, key metrics, and ongoing initiatives.
• Prepare and deliver detailed briefings on priority incidents, RCA, ensuring timely communication of root cause, impact analysis, mitigation steps, and next actions.
• Act as a primary point of contact for Incident escalations and maintain consistent, professional engagement with client stakeholders.
• Coordinate with cross-functional teams including Engineering, Development, Red Team, and Risk/Compliance.
• Identify gaps in existing SOC process and work with team members or other departments to create, modify standard operating procedures, to automate any mundane daily operational activities, ensuring Ops are run efficiently.

Interested applicants, please Email, [e-mail]

Fabian Ling Tuong Liing

R25129353

Recruit Express Pte Ltd

EA Licence No: 99C4599

RCB No.: 199601303W

We regret that only shortlisted candidates will be contacted.