MDR Team Lead

RESOURCE CONSULTING PTE. LTD.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Sygnia in Singapore seeks an experienced MDR Team Lead to steer a 24/7 security operations team, combining hands-on threat hunting with people management.

You will mentor analysts, coordinate follow-the-sun shifts, and act as senior escalation for complex investigations, ensuring client SLAs and high technical standards.

This role partners with global MDR teams and the Site Manager to continuously improve detection and response capabilities in a fast-paced environment.

Qualifications

• 5+ years hands-on SOC/MDR/MSSP experience with monitoring, detection and IR.
• 1+ year leading security analysts with mentoring and shift planning.
• Experience with SIEM, EDR/XDR, network, identity, cloud, and endpoint telemetry.
• Hands-on experience with cloud platforms (AWS/Azure/GCP) and security tooling.

Responsibilities

• Lead, manage, and develop a team of MDR Analysts, providing coaching and performance feedback.
• Coordinate shift coverage and on-call allocation for 24/7 operations.
• Serve as senior escalation point for complex investigations and high-severity events.
• Manage alert queues to meet client SLAs and ensure proper investigation and escalation.

Skills

Team leadership

MDR/MSSP experience

SIEM/EDR/XDR

Cloud telemetry

English communication

Education

Bachelor’s degree in Cybersecurity/CS/IT

Tools

SIEM tools

EDR/XDR tools

Cloud logs analysis

Job description

Our client is a top-tier cyber consulting andincident response company, working with organizations worldwide to proSygnia is looking for an experienced MDR Team Lead to join its MDR Operations team in Singapore. This is a hands-on technical leadership role combining people management with advanced security operations. The Team Lead will manage and develop a team of MDR Analysts while serving as the senior technical authority on shift and the first point of escalation for complex investigations and high-severity security events. Working closely with the MDR Site Manager and Sygnia’s global MDR teams, the Team Lead will be responsible for maintaining high technical standards, meeting client SLAs, ensuring effective Follow-the-Sun operations, and continuously improving our detection and response capabilities.

Main Responsibilities

• Lead, manage, and professionally develop a team of MDR Analysts, providing ongoing technical coaching, mentoring, and performance feedback
• Manage team scheduling, shift coverage, and on-call allocation to support 24/7 Follow-the-Sun operations
• Serve as the senior technical escalation point for complex investigations and high-severity security events
• Manage alert queues and priorities, ensuring acknowledgement, investigation, and escalation are handled in accordance with client SLAs
• Monitor operational performance, identify potential SLA risks or bottlenecks, and proactively rebalance workloads when required
• Ensure effective cross-region shift handovers, including open investigations, client communications, and outstanding operational tasks
• Lead and support in-depth security investigations, including log-based forensic analysis across endpoint, network, identity, email, cloud, and application environments
• Continuously improve detection capabilities by tuning existing logic, reducing false positives, and translating threat intelligence and post-incident findings into new or enhanced detections
• Review analysts’ investigations, escalations, reports, and client communications to ensure technical accuracy, completeness, consistency, and professionalism
• Act as a technical point of contact for clients during security events, clearly communicating findings, risks, status updates, and recommended actions to both technical and non-technical stakeholders
• Produce and review client-ready incident and investigation reports, including timelines, root cause, impact assessments, and remediation recommendations
• Serve as the focal point between MDR and Incident Response teams when critical events require transition to full Incident Response
• Develop and maintain MDR procedures, runbooks, knowledge articles, and client-specific documentation
• Identify opportunities to improve MDR processes, methodologies, and operational efficiency
• Support the MDR Site Manager with ongoing operational activities and act on their behalf when required

Main Requirements

• At least 5 years of hands-on experience in SOC, MDR, or MSSP environments, including security monitoring, investigation, detection, and incident response.
• More than 1 year of experience leading or directly managing security analysts, including technical mentoring, performance management, and shift or resource planning.
• Strong hands-on investigation experience across SIEM, EDR/XDR, network, identity, email, cloud, and endpoint telemetry.
• Experience with forensic and incident response investigations, including host, network, and cloud log analysis.
• Strong understanding of security threats, attacker behavior, investigation methodologies, and incident response processes.
• Experience building, tuning, and improving detection scenarios and correlation logic.
• Hands-on experience investigating security events in at least one major cloud platform (AWS, Azure, or GCP).
• Experience analyzing network security telemetry, including firewalls, WAF, proxy, and DNS logs.
• Experience investigating EDR/XDR, Windows, Sysmon, identity, and email security telemetry.
• Familiarity with malware analysis and threat intelligence enrichment.
• Proven ability to produce high-quality incident and investigation reports for external clients.
• Experience working in a 24/7 or Follow-the-Sun operational environment.
• Strong leadership and coaching capabilities, with the ability to develop analysts while maintaining high technical and operational standards.
• Excellent written and verbal English, with the confidence to lead technical discussions with clients, including during high-pressure incidents.
• Strong judgment, prioritization, and decision-making skills, with the ability to manage multiple competing client priorities and SLAs.
• Proactive, accountable, and improvement-oriented mindset.
• Ability to support escalations and critical events outside regular working hours when required.
• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience.

We regret that only shortlisted candidates will be notified.

EA License No.: 08C3209

Registration No.: R1101742