Lead IT Specialist (Cybersecurity Incident Response)

Forensic Focus Limited; Singapore; On-site; SGD 90,000 - 130,000; Full time

Job summary

Forensic Focus Limited is seeking an experienced incident responder to lead end-to-end cybersecurity incident response activities, from triage to recovery, across endpoints, networks, cloud and applications. You will analyse logs, perform digital forensics, communicate with stakeholders, and contribute to SOAR automation and playbook development, guiding decision-makers under pressure.

This is a leadership role within a formal CIRT structure, requiring clear translation of complex findings into

Qualifications

• Experience with log analysis across EDR, network, cloud and applications.
• Hands-on digital forensics experience on endpoints, servers and mobile devices.
• Ability to communicate technical concepts clearly to stakeholders.
• Familiarity with SOAR platforms and automation capabilities.

Responsibilities

• Lead end-to-end cybersecurity incident response activities (triage to recovery).
• Analyse logs across endpoints, networks, cloud and applications, perform forensics.
• Communicate findings to stakeholders and guide decision-makers under pressure.
• Contribute to SOAR automation and playbook development.

Skills

Log analysis

EDR telemetry

Network traffic analysis

Cloud audit trails

Application logs

Digital forensics

SOAR platforms

Communication

Critical thinking

Leadership

Tools

SOAR platforms

Job description

The Role

This position leads end-to-end cybersecurity incident response activities, covering triage, investigation, containment, eradication, and recovery. Day-to-day work includes analysing logs across endpoints, networks, cloud, and applications, performing digital forensics across multiple device types, communicating with stakeholders, and contributing to SOAR automation and playbook development.

Skills & Experience

Candidates require strong log analysis skills spanning EDR telemetry, network traffic, cloud audit trails, and application logs, alongside hands‑on digital forensics experience covering endpoints, servers, mobile devices, and cloud environments. Critical thinking, clear communication of technical concepts, and familiarity with SOAR platforms are essential to this role.

Who It Suits

This role suits an experienced incident responder ready to take a leadership position within a formal CIRT structure. Someone who is comfortable guiding decision‑makers under pressure, conducting thorough root cause analysis, and translating complex technical findings into actionable recommendations for both technical and non-technical stakeholders will thrive here.