Job Description

ROLE PURPOSE

Lead ST Engineering's proactive, intelligence-led threat hunting services for enterprise, Operational Technology (OT) and Critical Information Infrastructure (CII) customers. Own the technical hunt lifecycle: threat intelligence → hypotheses → telemetry readiness → investigative queries → evidence validation → detection improvement→ customer reporting and incident/DFIR escalation. This is a hands-on technical leadership role, not solely SOC alert triage or project coordination.

KEY RESPONSIBILITIES

Threat intelligence, hunt planning and methodology

Define risk-based hunt strategies, monthly/ad hoc hunt plans, testable hypotheses, coverage objectives and measurable outcomes using customer operating context, critical assets and threat exposure.
Assess cyber threat intelligence, threat actors/campaigns, indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs) map hypotheses and observations to MITRE ATT&CK Enterprise and ATT&CK for ICS where relevant.

Telemetry assessment and OT environment understanding

Identify necessary log sources and artefacts across Windows/Linux hosts, OT engineering workstations, HMIs, authentication, privileged access, security devices, applications and networks identify monitoring and evidential blind spots.
Verify log ingestion and data quality, including parsing, timestamps, event coverage, field mapping, retention and searchability direct technical remediation with SIEM/platform engineers before interpreting hunt results.

Threat investigation and detection engineering

Lead complex IOC-, TTP- and behavior-driven hunts, perform SIEM correlation and investigative pivots, distinguish normal OT maintenance/administration from malicious activity, and assure evidence-backed conclusions.
Develop or review hunt analytics and detection use cases coordinate testing, false-positive tuning and approved operational handover of SIEM/UEBA/EDR/XDR/SOAR detection improvements to SOC or detection engineering teams.

Findings, customer communication and DFIR escalation

Review findings, severity and confidence present clear technical reports, recommended actions, telemetry limitations and senior-stakeholder briefings, with documented assumptions and evidence.
Escalate credible malicious activity promptly via agreed customer and 24×7 SOC channels coordinate handover to Incident Response/DFIR teams, preserving event timelines, affected assets, hunt logic and supporting evidence.

SOC integration, servicecoordination and leadership

Work closely with L1/L2/L3 SOC analysts operating 24×7×365, CTI, platform engineering, detection engineering and DFIR functions establish escalation criteria, investigation handoffs and incident feedback loops.
Mentor hunters, review technical outputs, maintain procedures, hunting content and improvement backlog provide workload forecasts and surge-support needs to the SOC/Service Delivery Manager for manpower planning.

MINIMUM EDUCATION ANDEXPERIENCE

Cybersecurity seniority: At least 7 years of relevant cybersecurity experience, including a minimum of 5 years in OT/ICS cybersecurity for engagements requiring that contractual threshold.
Specialist experience: At least 3 years of demonstrable hands-on threat hunting, advanced incident investigation/DFIR or detection engineering, including technical ownership of end-to-end hunts experience in customer-facing technical delivery.
Core technical skills: Strong working knowledge of cyber threat intelligence, ATT&CK, threat hypotheses, Windows/Linux and network artefacts, SIEM correlations, investigation techniques, query development and evidence interpretation.
OT and security stack: Knowledge of OT/ICS assets and architecture, OT asset management, patch management, Privileged Access Management (PAM), SIEM, UEBA, EDR, XDR and SOAR, and their roles in security visibility and response.
Service interfaces: Practical understanding of 24×7×365 SOC L1/L2/L3 operations, escalation pathways, surge prioritisation and secure customer communication. Hands-on experience with at least one SIEM query language (e.g. Elastic KQL/EQL, Splunk SPL or Microsoft Sentinel KQL).

PROFESSIONAL CERTIFICATIONS

Required: Hold at least one relevant, recognised cybersecurity certification appropriate to OT security, threat hunting, intrusion investigation or incident response. Examples include GIAC GICSP, GRID, GCFA, GCIH, GCDA or GCTI CREST Registered Intrusion Analyst(CRIA), Certified Incident Manager (CCIM) or Registered Threat Intelligence Analyst (CRTIA) or an equivalent qualification. The relevance, current status and any customer-mandated equivalence must be verified prior to assignment.

Preferred: ComplementaryOT/ICS and investigation/detection qualifications (e.g. GICSP/GRID plusGCFA/GCDA/CRIA), CISSP or CISM for broader security leadership, andvendor-specific SIEM/EDR qualifications. A CTI-only or governance-onlycertificate does not substitute for proven hands-on hunting ability.

PREFERRED CAPABILITIES

Experience in critical infrastructure, transport, utilities, safety-sensitive or segmented/air-gapped OT environments familiarity with operational restrictions on active testing and response.
Scripting for data transformation, triage and automation (Python/PowerShell) detection-as-code, Sigma, Sysmon, threat emulation and management of reusable hunt content.

TECHNICAL SCREENING EXPECTATION

Candidates should demonstrate a real intelligence-to-hunt case: threat trigger, customer relevance, hypothesis, required datasets/fields, parsing checks, representative query logic, evidence pivots, benign explanations, validated findings, detection enhancements and customer/DFIR escalation decision.

Work location: Jurong East