SL2471 - Information Security (Managed Detection and Response)

FPT Asia Pacific Pte Ltd; Singapore; On-site; SGD 180,000 - 260,000; Full time

Job summary

Singlife seeks a senior cyber security leader to take command of major incidents, own the full DFIR lifecycle, and drive defence strategy aligned to MAS TRM, NIST CSF v2.0 and ISO/IEC 27001:2022. You will govern SIEM, SOAR, EDR and DLP, lead threat hunting, and mentor a high-performing team in a regulated financial services environment.

You will also shape telemetry, build automation, and oversee third-party partners while contributing to audits and board reporting.

Qualifications

• 8+ years in cyber security with hands-on DFIR and threat-hunting experience.
• Proven track record leading major incidents end-to-end.
• Strong knowledge of MAS TRM, NIST CSF v2.0, ISO/IEC 27001:2022, MITRE ATT&CK.
• Experience across cloud, endpoint, network and identity telemetry.

Responsibilities

• Take command of major cyber incidents and own end-to-end DFIR lifecycle.
• Set and drive cyber defence strategy aligned to industry standards.
• Govern and optimise SIEM, SOAR, EDR and DLP platforms for coverage.
• Lead detection engineering and threat hunting mapped to MITRE ATT&CK.
• Shape telemetry and logging strategy with prioritized log onboarding.
• Build security automation and orchestration for faster response.
• Adopt AI-enabled capabilities with appropriate guardrails.
• Develop and test incident response playbooks and runbooks.
• Manage external partners with SLA oversight and performance reviews.
• Define and track detection metrics (MTTD/MTTR) for continuous improvement.
• Mentor analysts and engineers to build a high-performing team.
• Support audits, regulatory engagements and board reporting.

Skills

DFIR

Detection Engineering

Threat Hunting

Security Automation

AI-enabled Security Operations

Incident response leadership

Cloud telemetry (AWS/Azure)

Automation & playbooks

MITRE ATT&CK

Regulated financial services knowledge

Education

Bachelor's degree in Computer Science, Information Security or related field

Tools

SIEM

SOAR

EDR

DLP

Job description

Responsibilities

• Take command of major cyber incidents and own the end-to-end DFIR lifecycle — from detection and containment through eradication, recovery and post-incident review.
• Set and drive the Group's cyber defence and detection-and-response strategy, aligned to MAS TRM, NIST CSF v2.0 and ISO/IEC 27001:2022.
• Govern and optimise our SIEM, SOAR, EDR and DLP platforms to maximise detection coverage, efficacy and value.
• Lead detection engineering and proactive, intelligence-led threat hunting mapped to the MITRE ATT&CK framework.
• Shape our security telemetry and logging strategy, prioritising log source onboarding for comprehensive coverage.
• Build security automation and orchestration that make detection and response faster, more consistent and higher quality.
• Adopt and govern AI-enabled capabilities to strengthen security operations while keeping the right guardrails in place.
• Develop, maintain and regularly test incident response playbooks, runbooks and cyber crisis and tabletop exercises.
• Manage external forensic, MDR and threat-intelligence partners, including onboarding, performance and SLA oversight.
• Define, track and report detection-and-response metrics (such as MTTD and MTTR) to drive continuous improvement.
• Mentor analysts and engineers, sharing your expertise to build a high-performing, resilient and collaborative team.
• Support audits, regulatory engagements and executive/Board reporting, and represent Singlife in industry threat-sharing communities.

Requirements

• 8+ years in cyber security, with deep, hands-on expertise in DFIR, Detection Engineering, Threat Hunting, SIEM, SOAR, EDR, DLP, security automation and AI-enabled Security Operations.
• A proven track record leading major cyber incidents and complex forensic investigations from start to finish.
• Strong working knowledge of MAS TRM, NIST CSF v2.0, ISO/IEC 27001:2022 and the MITRE ATT&CK framework.
• Hands-on experience across cloud (AWS/Azure), endpoint, network and identity telemetry, detection-as-code and automation.
• Experience in a regulated financial services or insurance environment (strongly preferred).
• A Bachelor's degree in Computer Science, Information Security or a related field, or equivalent professional experience.
• One or more relevant certifications — CISSP, GCFA, GCIH, GNFA, GREM, GCTI or equivalent.
• Calm, decisive leadership under pressure, sharp analytical thinking, and the ability to translate technical risk clearly for management and stakeholders.