Threat Hunter Lead

ROLE PURPOSE

Lead ST Engineering’s proactive, intelligence-led threat hunting services for enterprise, Operational Technology (OT) and Critical Information Infrastructure (CII) customers. Own the technical hunt lifecycle: threat intelligence → hypotheses → telemetry readiness → investigative queries → evidence validation → detection improvement → customer reporting and incident/DFIR escalation. This is a hands-on technical leadership role, not solely SOC alert triage or project coordination.

KEY RESPONSIBILITIES

Threat intelligence, hunt planning and methodology

• Define risk-based hunt strategies, monthly/ad hoc hunt plans, testable hypotheses, coverage objectives and measurable outcomes using customer operating context, critical assets and threat exposure.
• Assess cyber threat intelligence, threat actors/campaigns, indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs); map hypotheses and observations to MITRE ATT&CK Enterprise and ATT&CK for ICS where relevant.

Telemetry assessment and OT environment understanding

• Identify necessary log sources and artefacts across Windows/Linux hosts, OT engineering workstations, HMIs, authentication, privileged access, security devices, applications and networks; identify monitoring and evidential blind spots.
• Verify log ingestion and data quality, including parsing, timestamps, event coverage, field mapping, retention and searchability; direct technical remediation with SIEM/platform engineers before interpreting hunt results.

Threat investigation and detection engineering

• Lead complex IOC-, TTP- and behaviour-driven hunts, perform SIEM correlation and investigative pivots, distinguish normal OT maintenance/administration from malicious activity, and assure evidence-backed conclusions.
• Develop or review hunt analytics and detection use cases; coordinate testing, false-positive tuning and approved operational handover of SIEM/UEBA/EDR/XDR/SOAR detection improvements to SOC or detection engineering teams.

Findings, customer communication and DFIR escalation

• Review findings, severity and confidence; present clear technical reports, recommended actions, telemetry limitations and senior-stakeholder briefings, with documented assumptions and evidence.
• Escalate credible malicious activity promptly via agreed customer and 24×7 SOC channels; coordinate handover to Incident Response/DFIR teams, preserving event timelines, affected assets, hunt logic and supporting evidence.

SOC integration, service coordination and leadership

• Work closely with L1/L2/L3 SOC analysts operating 24×7×365, CTI, platform engineering, detection engineering and DFIR functions; establish escalation criteria, investigation handoffs and incident feedback loops.
• Mentor hunters, review technical outputs, maintain procedures, hunting content and improvement backlog; provide workload forecasts and surge-support needs to the SOC/Service Delivery Manager for manpower planning.

MINIMUM EDUCATION AND EXPERIENCE

• Cybersecurity seniority: At least 7 years of relevant cybersecurity experience, including a minimum of 5 years in OT/ICS cybersecurity for engagements requiring that contractual threshold.
• Specialist experience: At least 3 years of demonstrable hands-on threat hunting, advanced incident investigation/DFIR or detection engineering, including technical ownership of end-to-end hunts; experience in customer-facing technical delivery.
• Core technical skills: Strong working knowledge of cyber threat intelligence, ATT&CK, threat hypotheses, Windows/Linux and network artefacts, SIEM correlations, investigation techniques, query development and evidence interpretation.
• OT and security stack: Knowledge of OT/ICS assets and architecture, OT asset management, patch management, Privileged Access Management (PAM), SIEM, UEBA, EDR, XDR and SOAR, and their roles in security visibility and response.
• Service interfaces: Practical understanding of 24×7×365 SOC L1/L2/L3 operations, escalation pathways, surge prioritisation and secure customer communication. Hands-on experience with at least one SIEM query language (e.g. Elastic KQL/EQL, Splunk SPL or Microsoft Sentinel KQL).

PROFESSIONAL CERTIFICATIONS

Required: Hold at least one relevant, recognised cybersecurity certification appropriate to OT security, threat hunting, intrusion investigation or incident response. Examples include GIAC GICSP, GRID, GCFA, GCIH, GCDA or GCTI; CREST Registered Intrusion Analyst (CRIA), Certified Incident Manager (CCIM) or Registered Threat Intelligence Analyst (CRTIA); or an equivalent qualification. The relevance, current status and any customer-mandated equivalence must be verified prior to assignment.

Preferred: Complementary OT/ICS and investigation/detection qualifications (e.g. GICSP/GRID plus GCFA/GCDA/CRIA), CISSP or CISM for broader security leadership, and vendor-specific SIEM/EDR qualifications. A CTI-only or governance-only certificate does not substitute for proven hands-on hunting ability.

PREFERRED CAPABILITIES

• Experience in critical infrastructure, transport, utilities, safety-sensitive or segmented/air-gapped OT environments; familiarity with operational restrictions on active testing and response.
• Scripting for data transformation, triage and automation (Python/PowerShell); detection-as-code, Sigma, Sysmon, threat emulation and management of reusable hunt content.

TECHNICAL SCREENING EXPECTATION

Candidates should demonstrate a real intelligence-to-hunt case: threat trigger, customer relevance, hypothesis, required datasets/fields, parsing checks, representative query logic, evidence pivots, benign explanations, validated findings, detection enhancements and customer/DFIR escalation decision.

Work location: Jurong East