Threat Detection Engineer: Hunt & Automate Detections

morgan stanley; Singapore; On-site; SGD 90,000 - 130,000; Full time

Job summary

Morgan Stanley in Singapore is seeking a detection engineer with a threat hunting mindset to join a global team. You will develop and maintain detection logic across endpoints, network, and telemetry sources, using Python to build automation and enrich security data.

You will translate threat intelligence into practical detection strategies, work with Sigma, YARA, ElasticSearch, Git, and related platforms, and collaborate with threat intel and incident response teams to improve coverage and

Qualifications

• Min 3 years of hands‑on experience in cybersecurity, threat intelligence, threat hunting, detection engineering, security engineering, or related field.
• Strong Python development skills with the ability to write maintainable code, work with APIs, process data, automate workflows, and troubleshoot issues.
• Practical experience analyzing security data, logs, alerts, or telemetry to identify suspicious activity or understand adversary behavior.
• Familiarity with detection engineering concepts, including detection logic, rule tuning, alert quality, false‑positive reduction, and detection validation.
• Working knowledge of adversary tactics, techniques, and procedures, including converting behavior into detection opportunities.
• Experience with ElasticSearch, Sigma, YARA, Git, SIEM platforms, EDR telemetry, or similar systems.
• Ability to translate threat intelligence into hunting or detection opportunities and to communicate findings clearly.

Responsibilities

• Develop, test, tune, and maintain detection logic across endpoints, networks, identities, and telemetry sources.
• Translate adversary behaviors and threat intel into practical detection coverage.
• Use Python to build automation, parse and enrich security data, and support tooling workflows.
• Work with Sigma, YARA, ElasticSearch, Git, Python, and related platforms to create and maintain detection content.
• Investigate signals to understand attacker behavior and improve detection coverage.
• Collaborate with threat intel, incident response, purple team, and platform engineering stakeholders.
• Research emerging adversary tradecraft and attack patterns relevant to the Firm’s threat landscape.
• Map detection opportunities to MITRE ATT&CK and related frameworks.
• Contribute to peer reviews of detection logic, Python code, and automation changes for quality and consistency.
• Help improve detection-as-code practices, testing processes, and engineering standards.
• Continue building depth in detection engineering, threat hunting, and financial-sector cyber threats.

Skills

Python

Threat hunting

Cybersecurity

Detection engineering

Threat intelligence

Analytics

Tools

ElasticSearch

Sigma

YARA

Git

SIEM

EDR

Job description

Morgan Stanley in Singapore is seeking a detection engineer with a threat hunting mindset to join a global team. You will develop and maintain detection logic across endpoints, network, and telemetry sources, using Python to build automation and enrich security data.

You will translate threat intelligence into practical detection strategies, work with Sigma, YARA, ElasticSearch, Git, and related platforms, and collaborate with threat intel and incident response teams to improve coverage and