Threat Hunting Lead (DSC/JH)

ST Engineering; Singapore; On-site; SGD 180,000 - 250,000; Full time

Job summary

ST Engineering is seeking a hands-on Senior Threat Hunter to lead proactive threat hunting across OT/ICS environments for critical infrastructure clients. You will own the full hunt lifecycle from intelligence to evidence validation, guiding SIEM/EDR/XDR improvements and DFIR escalation as needed.

You will coordinate with L1–L3 SOC teams, craft hunt content, and mentor analysts while ensuring strict security controls and customer communication during incidents.

Qualifications

• Minimum 7 years in cybersecurity with OT/ICS focus.
• Hands-on threat hunting and end-to-end incident investigations.
• Customer-facing technical delivery experience.
• Strong knowledge of ATT&CK and OT security architectures.
• Experience with SOC operations and 24/7 incident coordination.

Responsibilities

• Define threat hunt strategies and hypotheses based on client context.
• Lead IOC-, TTP- and behavior-driven hunts and SIEM investigations.
• Develop or review hunt analytics and detection use cases.
• Provide evidence-backed findings and customer-facing reports.
• Mentor SOC analysts and coordinate handovers to DFIR teams.

Skills

Threat hunting

OT/ICS security

SIEM

DFIR

Incident response

Threat intelligence

MITRE ATT&CK

Tools

Elastic KQL

Splunk SPL

Job description

Lead ST Engineering’s proactive, intelligence-led threat hunting services for enterprise, Operational Technology (OT) and Critical Information Infrastructure (CII) customers. Own the technical hunt lifecycle: threat intelligence → hypotheses → telemetry readiness → investigative queries → evidence validation → detection improvement → customer reporting and incident/DFIR escalation. This is a hands-on technical leadership role, not solely SOC alert triage or project coordination.

KEY RESPONSIBILITIES

Threat intelligence, hunt planning and methodology

• Define risk-based hunt strategies, monthly/ad hoc hunt plans, testable hypotheses, coverage objectives and measurable outcomes using customer operating context, critical assets and threat exposure.
• Assess cyber threat intelligence, threat actors/campaigns, indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs); map hypotheses and observations to MITRE ATT&CK Enterprise and ATT&CK for ICS where relevant.

Telemetry assessment and OT environment understanding

• Identify necessary log sources and artefacts across Windows/Linux hosts, OT engineering workstations, HMIs, authentication, privileged access, security devices, applications and networks; identify monitoring and evidential blind spots.
• Verify log ingestion and data quality, including parsing, timestamps, event coverage, field mapping, retention and searchability; direct technical remediation with SIEM/platform engineers before interpreting hunt results.

Threat investigation and detection engineering

• Lead complex IOC-, TTP- and behaviour-driven hunts, perform SIEM correlation and investigative pivots, distinguish normal OT maintenance/administration from malicious activity, and assure evidence-backed conclusions.
• Develop or review hunt analytics and detection use cases; coordinate testing, false-positive tuning and approved operational handover of SIEM/UEBA/EDR/XDR/SOAR detection improvements to SOC or detection engineering teams.

Findings, customer communication and DFIR escalation

• Review findings, severity and confidence; present clear technical reports, recommended actions, telemetry limitations and senior-stakeholder briefings, with documented assumptions and evidence.
• Escalate credible malicious activity promptly via agreed customer and 24×7 SOC channels; coordinate handover to Incident Response/DFIR teams, preserving event timelines, affected assets, hunt logic and supporting evidence.

SOC integration, service coordination and leadership

• Work closely with L1/L2/L3 SOC analysts operating 24×7×365, CTI, platform engineering, detection engineering and DFIR functions; establish escalation criteria, investigation handoffs and incident feedback loops.
• Mentor hunters, review technical outputs, maintain procedures, hunting content and improvement backlog; provide workload forecasts and surge-support needs to the SOC/Service Delivery Manager for manpower planning.

MINIMUM EDUCATION AND EXPERIENCE

• Cybersecurity seniority: At least 7 years of relevant cybersecurity experience, including a minimum of 5 years in OT/ICS cybersecurity for engagements requiring that contractual threshold.
• Specialist experience: At least 3 years of demonstrable hands-on threat hunting, advanced incident investigation/DFIR or detection engineering, including technical ownership of end-to-end hunts; experience in customer-facing technical delivery.
• Core technical skills: Strong working knowledge of cyber threat intelligence, ATT&CK, threat hypotheses, Windows/Linux and network artefacts, SIEM correlations, investigation techniques, query development and evidence interpretation.
• OT and security stack: Knowledge of OT/ICS assets and architecture, OT asset management, patch management, Privileged Access Management (PAM), SIEM, UEBA, EDR, XDR and SOAR, and their roles in security visibility and response.
• Service interfaces: Practical understanding of 24×7×365 SOC L1/L2/L3 operations, escalation pathways, surge prioritisation and secure customer communication. Hands-on experience with at least one SIEM query language (e.g. Elastic KQL/EQL, Splunk SPL or Microsoft Sentinel KQL).

PROFESSIONAL CERTIFICATIONS

Required: Hold at least one relevant, recognised cybersecurity certification appropriate to OT security, threat hunting, intrusion investigation or incident response. Examples include GIAC GICSP, GRID, GCFA, GCIH, GCDA or GCTI; CREST Registered Intrusion Analyst (CRIA), Certified Incident Manager (CCIM) or Registered Threat Intelligence Analyst (CRTIA); or an equivalent qualification. The relevance, current status and any customer-mandated equivalence must be verified prior to assignment.

Preferred: Complementary OT/ICS and investigation/detection qualifications (e.g. GICSP/GRID plus GCFA/GCDA/CRIA), CISSP or CISM for broader security leadership, and vendor-specific SIEM/EDR qualifications. A CTI-only or governance-only certificate does not substitute for proven hands-on hunting ability.

PREFERRED CAPABILITIES

• Experience in critical infrastructure, transport, utilities, safety-sensitive or segmented/air-gapped OT environments; familiarity with operational restrictions on active testing and response.
• Scripting for data transformation, triage and automation (Python/PowerShell); detection-as-code, Sigma, Sysmon, threat emulation and management of reusable hunt content.

TECHNICAL SCREENING EXPECTATION

Candidates should demonstrate a real intelligence-to-hunt case: threat trigger, customer relevance, hypothesis, required datasets/fields, parsing checks, representative query logic, evidence pivots, benign explanations, validated findings, detection enhancements and customer/DFIR escalation decision.