Senior Threat Intel & Incident Response Engineer

SPH Media; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

SPH Media is seeking a highly technical cybersecurity professional to drive Threat Intelligence, Incident Response, and advanced threat detection. This senior individual contributor will own cybersecurity products and capabilities end-to-end.

The role covers Threat Hunting, Detection Engineering, cloud security across AWS/Azure/GCP, and lifecycle management of security tools. You will lead investigations, develop detections, and work closely with engineers to strengthen controls.

Qualifications

• 5-8+ years of hands-on experience in Incident Response, Threat Hunting, or Threat Intelligence.
• Strong experience with EDR platforms such as CrowdStrike (querying, investigation, live response).
• Proven ability to independently investigate and respond to real-world cyber incidents.
• Experience writing detection logic (KQL, SPL, Sigma, etc.).
• Solid understanding of attacker techniques (lateral movement, persistence, C2, credential abuse).
• Hands-on experience in cloud security investigations (AWS, Azure, or GCP).
• Scripting skills (Python, PowerShell, or Bash).

Responsibilities

• Actively collect, analyse, and operationalise intelligence from OSINT, dark web, commercial feeds, and ISACs.
• Lead and execute end-to-end incident response activities (triage, containment, eradication, recovery).
• Develop and execute proactive threat hunting across endpoint, identity, and cloud telemetry.
• Investigate threats in AWS, Azure, and GCP environments, analyzing cloud logs for suspicious activity.
• Identify phishing campaigns, malicious domains, and impersonation attempts; support takedown operations.

Skills

Threat Intelligence

Incident Response

Threat Hunting

Detection Engineering

Cloud Security

Scripting (Python)

MITRE ATT&CK

CrowdStrike

SIEM

KQL/Sigma

Tools

CrowdStrike Falcon

Splunk

KQL

Sigma

Job description

SPH Media is seeking a highly technical cybersecurity professional to drive Threat Intelligence, Incident Response, and advanced threat detection. This senior individual contributor will own cybersecurity products and capabilities end-to-end.

The role covers Threat Hunting, Detection Engineering, cloud security across AWS/Azure/GCP, and lifecycle management of security tools. You will lead investigations, develop detections, and work closely with engineers to strengthen controls.