Threat Detection Engineer: SIEM/EDR/NDR Expert

ICE Clear Europe Limited; Singapore; Sur place; SGD 90 000 - 150 000; Plein temps

Résumé du poste

The ICE Cybersecurity Threat Detection team in ICE Clear Singapore detects malicious activity across ICE's global infrastructure, building and tuning detection content for SIEM, EDR, and NDR platforms. You will hunt proactively, refine detections, and collaborate with threat intelligence and incident response to cover evolving adversary techniques.

The role emphasizes hands-on engineering, tuning, and threat hunting across Windows, Linux, and cloud telemetry, with opportunities to advance

Qualifications

• University degree in Engineering, MIS, CIS, or related discipline or equivalent years of experience.
• 3+ years of relevant experience in threat detection, security operations, or threat hunting.
• Hands on, day to day experience with SIEM, EDR, and NDR platforms, including writing and tuning detection logic.
• Working knowledge of a scripting language for automation, at the level needed to build useful internal tooling.
• Demonstrated ability to investigate suspicious activity end to end: read the logs, form a conclusion, and communicate it clearly.
• Familiarity with the MITRE ATT&CK framework and the ability to reason about adversary tradecraft.
• Solid understanding of operating system internals, networking, and authentication as they appear in security telemetry.

Responsabilités

• Detection Engineering - Design, build, test, and maintain detection content across SIEM, EDR, and NDR platforms, and document the intent, data source, and expected behavior of each detection
• Detection Tuning and Health - Own false positive rates, alert volume, and rule health for assigned detection areas, including retiring logic that no longer earns its place
• Detection Coverage - Map detection coverage to the MITRE ATT&CK framework, identify gaps, and propose the telemetry or logic needed to close them
• Threat Intelligence Integration - Convert threat intelligence reporting into prioritized detection and hunting work, so coverage follows the adversaries and techniques most relevant to the sector rather than whatever arrived most recently
• Proactive Threat Hunting - Develop and execute focused hunts to discover threats that evade existing controls, and promote successful hunt outcomes into durable production detections
• Red Team Gap Remediation - Take ownership of detection gaps reported through red team and purple team exercises; track each gap to closure, build or amend the detection, and validate that the exercise activity is caught on retest
• Log Source Health - Validate the health and completeness of security log sources, detect collection failures and silent feeds, and onboard or update SIEM log sources in a timely manner
• Automation and Tooling - Apply a developer and problem-solving mindset to the work, using scripting to build internal tooling, process and normalize data, and remove repetitive manual effort wherever it appears

Connaissances

Threat detection

Security operations

Threat hunting

Investigation

MITRE ATT&CK

Formation

University degree in Engineering or related discipline

Outils

SIEM

EDR

NDR

Sigma rules

Git workflows

Python scripting

PowerShell

Tanium

CrowdStrike

SentinelOne

Splunk

Elasticsearch

Description du poste

The ICE Cybersecurity Threat Detection team in ICE Clear Singapore detects malicious activity across ICE's global infrastructure, building and tuning detection content for SIEM, EDR, and NDR platforms. You will hunt proactively, refine detections, and collaborate with threat intelligence and incident response to cover evolving adversary techniques.

The role emphasizes hands-on engineering, tuning, and threat hunting across Windows, Linux, and cloud telemetry, with opportunities to advance