What you will be working on
As a Security Incident Responder in our Security Incident Response Team (SIRT), you will serve as the key technical lead in managing active security incidents. Beyond incident response, you will contribute to proactive security activities including threat intelligence, threat hunting, and red/purple team engagements. You will also work closely with project teams on security onboarding and provide leadership and guidance to L1 SOC Analysts.

In this role, you will:

Incident Response Leadership

• Serve as the technical lead during active security incidents, working closely with the Incident Commander to coordinate and execute response actions across technical teams and stakeholders.
• Manage end-to-end incident workstreams from initial triage and containment through to eradication, recovery, and post-incident review, in adherence with the organisation's Incident Management Framework and defined service level agreements.
• Lead root cause analysis and post-incident reviews, translating findings into actionable improvements to prevent recurrence.
• Prepare and maintain accurate incident reports, situation updates and timely communications for internal stakeholders and regulatory authorities, where required.
• Act as the primary escalation point for L1 SOC analysts during high-severity or complex incidents, providing technical guidance and decision support.

Stakeholder Coordination & Communication

• Work closely with the Incident Commander to ensure all internal and external stakeholders are kept informed, with clear roles, responsibilities, and communication channels maintained throughout the incident lifecycle.
• Liaise with regulatory authorities and external parties as required during incident handling, reporting, and post-incident follow-up.
• Collaborate with infrastructure, network, application, and data teams to drive effective containment, investigation, and remediation efforts.
• Provide timely and accurate technical situation updates to the Incident Commander and security leadership.

Threat Intelligence & Proactive Security

• Contribute to threat intelligence activities, including the analysis of threat actor Techniques, Tactics and Procedures (TTPs), Indicators of Compromise (IOC) management, and intelligence-led detection improvements.
• Lead or support threat hunting exercises to proactively identify hidden threats, anomalous behaviours, and gaps in detection coverage across the environment.
• Engage in red team and purple team activities to test and validate detection and response capabilities, translating findings into operational improvements.

Detection Engineering & SOC Development

• Work closely with SIEM, Detection, and Workflow Engineers to develop, tune and optimise detection rules, correlation logic and automated response workflows.
• Partner with project teams to onboard new systems and platforms into security monitoring, ensuring adequate detection coverage and logging standards.
• Drive the development and refinement of incident response playbooks, standard operating procedures and escalation frameworks.

Operational Excellence & Improvement

• Champion continuous service improvement initiatives, including post-incident reviews, trend analysis, metrics reporting and operational maturity assessments.
• Apply AI-assisted tools and platforms, including GenAI-powered analytics and AI agents, to enhance threat detection, automate routine activities and improve incident investigation workflows.
• Contribute to the evaluation and adoption of new security technologies, tools, and methodologies to strengthen the organisation's security posture.

What we are looking for
We value the diverse talents and experiences that each individual brings to the table. While mastery of every requirement may not be necessary, familiarity and expertise in some of the following areas will position you for success within this team.

• Relevant experience in security operations, incident response, or related cybersecurity roles.
• Demonstrated ability to lead incident response workstreams in coordination with an Incident Commander, exercising sound judgement and composure in time-critical, high-pressure situations.
• Hands-on experience with SIEM platforms, EDR/XDR, WAF, NDR/IDS/IPS, and vulnerability management tool.
• In-depth knowledge of Incident Management Frameworks and practices, including ITIL processes, incident severity classification and escalation protocols.
• Good understanding of the cyber threat landscape, including advanced attack vectors, TTPs, threat actor profiling, and the MITRE ATT&CK framework.
• Ability to convey complex technical findings clearly to both technical and non-technical audiences, including senior stakeholders.
• Familiarity with relevant cybersecurity regulatory requirements, standards and frameworks, such as  CyberSecurity Code of Practice (CCoP), ISO 27001, NIST, CIS Controls.
• Experience with threat intelligence, threat hunting methodologies, and/or red/purple team engagements would be advantageous.
• Familiarity with network protocols, operating systems (Windows and Linux), and cloud environments (AWS and Azure) would be advantageous.
• Experience with GenAI tools, AI-assisted security platforms or AI agents for security operations use cases would be advantageous.
• Relevant cybersecurity certifications such as GCIH, GCFA, CISSP, CISM, OSCP or equivalent would be advantageous.
• Ability to perform on-call and standby duties as part of a rostered 24/7 support arrangement, including call-out support during nights, weekends, and public holidays.

The seniority of appointment and actual corporate job title will commensurate with individual work experiences.

Position is on a 2-year full-time contract directly under the payroll of CPF Board with potential for emplacement into a permanent position