Senior / Network Security Consultant (NDR and EDR)

Central Provident Fund Board; Singapore; On-site; SGD 90,000 - 130,000; Full time

Job summary

Central Provident Fund Board in Singapore seeks an NDR/EDR Engineer to protect systems, networks and endpoints from cyber threats. You will deploy and tune NDR/EDR across on‑premises and cloud, aligned with security policies.

You will develop detection rules, triage alerts, support incident response and investigations, and conduct proactive threat hunting to identify adversaries targeting government infrastructure.

Qualifications

• Experience in cybersecurity engineering or security operations.
• Hands-on experience with EDR and/or NDR platforms.
• Knowledge of MITRE ATT&CK framework is a plus.
• Experience with SIEM and telemetry tools.
• Ability to develop and tune detection rules.

Responsibilities

• Deploy, configure, and maintain NDR/EDR across on-premises and cloud environments.
• Develop, tune, and maintain detection rules and alert policies.
• Monitor, triage security alerts, and escalate incidents to SOC/IR teams.
• Support incident response and forensic investigations.
• Conduct proactive threat hunting using telemetry to identify indicators of compromise.
• Integrate NDR/EDR with SIEM and SOAR platforms to enable workflows.
• Ensure configurations comply with security guidelines and maintain runbooks.

Skills

Cybersecurity engineering

Security operations

Threat hunting

Incident response

Forensic investigations

SIEM

Cloud and on-premises sec

KQL

Tools

CrowdStrike Falcon

Microsoft Defender for Endpoint

Trend Vision One

Darktrace

ExtraHop

Vectra AI

Corelight

Splunk

Microsoft Sentinel

QRadar

Sysmon

auditd

osquery

Job description

What the role is:

At #TeamCPF, you’re not just joining a team; you are embracing a culture of excellence, collaboration, and meaningful impact. You will play a pivotal role in empowering over 4 million members to secure their retirement, healthcare, housing needs and better navigate life’s uncertainties.We thrive on sharp minds and insightful decisions. Your ability to analyse and think critically isn't just valued; it's essential. Every choice you make contributes to our collective success.Collaboration is our way of life. We believe in the power of effective partnerships and seamless communications across teams. Together, we amplify each other’s strengths and achieve remarkable results.Our learning never stops. We encourage your inquisitiveness and courage to embrace new challenges head‑on. Your agility, readiness to challenge conventions, embrace of data-driven strategies, dedication to learning and applying new skills fuels our innovation and progress.At the core of everything we do lies a genuine desire to make a difference. We serve our community and support each other with compassion, empathy, and unwavering dedications. Every action we take is guided by a deep sense of purpose and a commitment to those we serve.Join us at #TeamCPF! Together, let's redefine possibilities and leave a legacy that echoes for generations.

What you will be working on:

You will be part of the Board’s network security team responsible for protecting systems, networks, and endpoints from cybersecurity threats. As an NDR & EDR Engineer, you will manage and operationalise Network Detection and Response (NDR) and Endpoint Detection and Response (EDR) platforms, working closely with internal teams to ensure robust threat detection and response capabilities.In this role, you will:

• Deploy, configure, and maintain NDR and EDR solutions across on-premises and cloud environments, in accordance with applicable ICT security policies and standards.
• Develop, tune, and maintain detection rules and alert policies to improve detection accuracy and minimise false positives across networks and endpoints.
• Monitor, triage security alerts and elevate incidents to the SOC or Incident Response team in accordance with established procedures.
• Support incident response and forensic investigations, including analysis of endpoint and network telemetry, evidence handling and reporting.
• Conduct proactive threat hunting using NDR and EDR telemetry to identify indicators of compromise, suspicious and advanced persistent threats (APTs) targeting government infrastructure.
• Integrate NDR and EDR platforms with SIEM and security orchestration tools to support effective detection, investigation and response workflows.
• Ensure platform configurations and detection logic comply with applicable security frameworks, including the Government Instruction Manual on IT Management (IM8) and relevant cybersecurity guidelines.
• Maintain accurate and up-to-date documentation including platform configurations, standard operating procedures, and incident runbooks.
• Liaise with vendors, GovTech and internal stakeholders on platform updates, threat intelligence sharing, security advisories and related operational matters.

What we are looking for:

We value the diverse talents and experiences that each individual brings to the table. While mastery of every requirement may not be necessary, familiarity and expertise in some of the following areas will position you for success within this team.

• Experience in cybersecurity engineering or security operations, including hands‑on experience with EDR and/or NDR platforms such as CrowdStrike Falcon, Microsoft Defender for Endpoint, Trend Vision One, Darktrace, ExtraHop, Vectra AI or Corelight.
• Knowledge of network protocols, traffic analysis, and endpoint telemetry and forensic investigation techniques
• Good understanding of Windows and Linux internals, including processes, memory, registry and security models, with experience analysing event logs for threat detection.
• Familiarity with attack and persistence techniques (e.g. Pass-the-Hash, Kerberoasting, LOLBins, privilege escalation, SSH persistent) and their mapping to the MITRE ATT&CK framework, as well as experience deploying EDR agents and telemetry tools like Sysmon, auditd, and osquery.
• Proficiency in using SIEM platforms (e.g. Splunk, Microsoft Sentinel, QRadar) for security log analysis and investigation.
• Ability to develop and tune detection rules and queries using languages and formats such as KQL,