Lead Threat Hunter, OT/ICS & Threat Intelligence

ST Engineering; Singapore; Presencial; SGD 180.000 - 240.000; Jornada completa

Descripción de la vacante

ST Engineering is seeking a hands-on Threat Hunting Lead to guide intelligence-led hunts for OT/ICS and critical infrastructure customers in Singapore. You will own the threat-hunting lifecycle from intelligence to evidence validation and reporting, working across SOC and DFIR teams.

Applicants should bring 7+ years in cybersecurity with 5+ in OT/ICS, strong ATT&CK knowledge, and experience delivering customer-facing technical services.

Formación

• 7+ years cybersecurity experience including 5+ years in OT/ICS.
• At least 3 years hands-on threat hunting and DFIR with end-to-end hunts.
• Strong knowledge of MITRE ATT&CK, Windows/Linux and network artefacts; SIEM correlations.
• Hands-on with at least one SIEM query language.
• Understanding of 24×7 SOC operations, escalation pathways and customer communication.

Responsabilidades

• Lead threat intelligence, hunt planning and hypothesis testing.
• Perform IOC-, TTP- and behaviour-driven hunts with SIEM pivots.
• Develop or review hunt analytics and detection use cases.
• Coordinate testing, false-positive tuning and secure handover to SOC teams.
• Present findings and recommended actions to senior stakeholders.

Conocimientos

Threat hunting

Threat intelligence

Incident investigation/DFIR

Detection engineering

Windows/Linux & network artefacts

SIEM correlations

Investigation techniques

Query development

Evidence interpretation

PAM / Privileged Access Management

Educación

7+ years cybersecurity experience

5+ years OT/ICS cybersecurity

3+ years threat hunting / DFIR

Herramientas

SIEM

UEBA

EDR

XDR

SOAR

Elastic KQL

EQL

Splunk SPL

Microsoft Sentinel KQL

Descripción del empleo

ST Engineering is seeking a hands-on Threat Hunting Lead to guide intelligence-led hunts for OT/ICS and critical infrastructure customers in Singapore. You will own the threat-hunting lifecycle from intelligence to evidence validation and reporting, working across SOC and DFIR teams.

Applicants should bring 7+ years in cybersecurity with 5+ in OT/ICS, strong ATT&CK knowledge, and experience delivering customer-facing technical services.