Threat Hunting Lead (DSC/JH)

ST ENGINEERING INFO-SECURITY PTE. LTD.; Singapore; Vor Ort; SGD 120.000 - 190.000; Vollzeit

Zusammenfassung

ST Engineering Info-Security Pte. Ltd. is seeking a hands-on security leader to drive proactive threat hunting for enterprise, OT, and critical infrastructure customers.

You will own the technical hunt lifecycle from threat intelligence through hypotheses, telemetry readiness, investigative queries, evidence validation, and detection improvements. This is a hands-on leadership role requiring collaboration with SOC, DFIR, and detection engineering teams.

Qualifikationen

• Cybersecurity seniority with hands-on threat hunting and DFIR ownership.
• At least 7 years in cybersecurity, with 5+ years in OT/ICS security.
• Experience delivering customer-facing technical security services.

Aufgaben

• Lead threat intelligence, hunt planning, and methodology aligned to customer contexts, assets, and threat exposure.
• Coordinate telemetry readiness and log sources across Windows/Linux, OT devices, HMIs, and networks; ensure data quality.
• Lead complex IOC-, TTP-, and behavior-driven hunts with SIEM correlation and investigation pivots.
• Review findings, escalate, and hand over to DFIR with clear timelines and evidence.
• Mentor hunters and coordinate with SOC, detection engineering, and platform teams for enablement.

Kenntnisse

Threat hunting

OT/ICS cybersecurity

Threat intelligence

MITRE ATT&CK

SIEM analysis

EDR/XDR/SOAR

Team leadership

TA/TACTICS mapping

Tools

Splunk SPL

Elastic KQL/EQL

Microsoft Defender for Endpoint

SIEM/UEBA

Jobbeschreibung

ROLE PURPOSE

Lead ST Engineering's proactive, intelligence-led threat hunting services for enterprise, Operational Technology (OT) and Critical Information Infrastructure (CII) customers. Own the technical hunt lifecycle: threat intelligence → hypotheses → telemetry readiness → investigative queries → evidence validation → detection improvement→ customer reporting and incident/DFIR escalation. This is a hands‑on technical leadership role, not solely SOC alert triage or project coordination.

KEY RESPONSIBILITIES

• Threat intelligence, hunt planning and methodologyDefine risk-based hunt strategies, monthly/ad hoc hunt plans, testable hypotheses, coverage objectives and measurable outcomes using customer operating context, critical assets and threat exposure.Assess cyber threat intelligence, threat actors/campaigns, indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs); map hypotheses and observations to MITRE ATT&CK Enterprise and ATT&CK forICS where relevant.
• Telemetry assessment and OT environment understandingIdentify necessary log sources and artefacts across Windows/Linux hosts, OT engineering workstations, HMIs, authentication, privileged access, security devices, applications and networks; identify monitoring and evidential blind spots.Verify log ingestion and data quality, including parsing, timestamps, event coverage, field mapping, retention and searchability; direct technical remediation with SIEM/platform engineers before interpreting hunt results.
• Threat investigation and detection engineeringLead complex IOC-, TTP- and behavior-driven hunts, perform SIEM correlation and investigative pivots, distinguish normal OT maintenance/administration from malicious activity, and assure evidence-backed conclusions.Develop or review hunt analytics and detection use cases; coordinate testing, false-positive tuning and approved operational handover of SIEM/UEBA/EDR/XDR/SOAR detection improvements to SOC or detection engineering teams.
• Findings, customer communication and DFIR escalationReview findings, severity and confidence; present clear technical reports, recommended actions, telemetry limitations and senior-stakeholder briefings, with documented assumptions and evidence.Escalate credible malicious activity promptly via agreed customer and 24×7 SOC channels; coordinate handover to Incident Response/DFIR teams, preserving event timelines, affected assets, hunt logic and supporting evidence.
• SOC integration, servicecoordination and leadershipWork closely with L1/L2/L3 SOC analysts operating 24×7×365, CTI, platform engineering, detection engineering and DFIR functions; establish escalation criteria, investigation handoffs and incident feedback loops.Mentor hunters, review technical outputs, maintain procedures, hunting content and improvement backlog; provide workload forecasts and surge-support needs to the SOC/Service Delivery Manager for manpower planning.

MINIMUM EDUCATION ANDEXPERIENCE

• Cybersecurity seniority: At least 7 years of relevant cybersecurity experience, including a minimum of 5 years in OT/ICS cybersecurity for engagements requiring that contractual threshold.
• Specialist experience: At least 3 years of demonstrable hands‑on threat hunting, advanced incident investigation/DFIR or detection engineering, including technical ownership of end-to-end hunts; experience in customer-facing technical delivery.
• Core technical skills: Strong working knowledge of cyber threat intelligence, ATT&CK, threat hypotheses, Windows/Linux and network artefacts, SIEM correlations, investigation techniques, query development and evidence interpretation.
• OT and security stack: Knowledge of OT/ICS assets and architecture, OT asset management, patch management, Privileged Access Management (PAM), SIEM, UEBA, EDR, XDR and SOAR, and their roles in security visibility and response.
• Service interfaces: Practical understanding of 24×7×365 SOC L1/L2/L3 operations, escalation pathways, surge prioritisation and secure customer communication. Hands‑on experience with at least one SIEM query language (e.g. Elastic KQL/EQL, Splunk SPL or Microsoft Sentinel KQL).

PROFESSIONAL CERTIFICATIONS

• Required: Hold at least one relevant, recognised cybersecurity certification appropriate to OT security, threat hunting, intrusion investigation or incident response. Examples include GIAC GICSP, GRID, GCFA, GCIH, GCDA or GCTI; CREST Registered Intrusion Analyst(CRIA), Certified Incident Manager (CCIM) or Registered Threat Intelligence Analyst (CRTIA); or an equivalent qualification. The relevance, current status and any customer-mandated equivalence must be verified prior to assignment.
• Preferred: ComplementaryOT/ICS and investigation/detection qualifications (e.g. GICSP/GRID plusGCFA/GCDA/CRIA), CISSP or CISM for broader security leadership, andvendor-specific SIEM/EDR qualifications. A CTI-only or governance-onlycertificate does not substitute for proven h