Lead, Cyber Security Incident Response

CYGNIFY PTE. LTD.; Singapore; On-site; SGD 80,000 - 120,000; Full time

Job summary

A telecom cybersecurity firm in Singapore is seeking a Cyber Security Incident Response Lead to manage the entire incident lifecycle, from detection to closure. The ideal candidate should possess over 5 years of relevant experience in SOC or incident response, with strong expertise in SIEM and threat hunting. This position requires collaboration with various teams and a solid understanding of cloud security principles. Certifications such as CISSP or GCIH are preferred, offering an opportunity to lead critical cybersecurity initiatives.

Qualifications

• 5–8 years of experience in SOC, Incident Response, or Detection Engineering.
• Strong hands-on experience with SIEM, preferably Elastic.
• Expertise in incident response, threat hunting, and log correlation.
• Solid knowledge of MITRE ATT&CK and malware analysis.
• Experience with cloud security services like AWS, Azure, or GCP.

Responsibilities

• Own the cybersecurity incident lifecycle: monitoring, investigation, and response.
• Lead response to malware, data breaches, insider threats, and cloud security incidents.
• Perform threat hunting and forensic investigations.
• Build and manage SIEM detections.
• Collaborate with teams to present incident reports.

Skills

Incident response expertise

Threat hunting

Log analysis

Scripting (Python, Bash, PowerShell)

Tools

SIEM (Elastic, Splunk)

Job description

Role:Lead, Cyber Security Incident Response

Location: Singapore

We are partnering with a leading telecom client to hire a Cybersecurity Incident Response SME to lead end-to-end incident detection, investigation, and response across enterprise environments.

Responsibilities:

• Own the full cybersecurity incident lifecycle: monitoring, triage, investigation, containment, and closure
• Lead response to malware, data breaches, insider threats, and cloud security incidents
• Perform threat hunting, log analysis, and forensic investigations
• Build, tune, and manage SIEM detections (Elastic / ELK preferred)
• Improve MTTD/MTTR through continuous alert tuning and use-case development
• Collaborate with SOC, CSIRT, IT, Cloud, and external MSSP teams
• Present incident reports, root cause analysis, and remediation plans to stakeholders
  

Requirements

• 5–8 years of experience in SOC / Incident Response / Detection Engineering
• Strong hands-on experience with SIEM (Elastic preferred; Splunk acceptable)
• Expertise in incident response, threat hunting, and log correlation
• Solid knowledge of MITRE ATT&CK, malware analysis, and network security
• Exposure to cloud security (AWS / Azure / GCP)
• Scripting skills (Python / Bash / PowerShell) are a plus
• Relevant certifications (CISSP, GCIH, GCIA, CEH, Elastic) preferred