{"id":3462267,"url":"https://alion.io/job/st-engineering-threat-hunter-lead","title":"Threat Hunter Lead","company":{"id":1818473,"name":"ST Engineering","domain":"stengg.com","url":"https://alion.io/company/stengg","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":{"grade":"A","score":100,"open_postings":9,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":17,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Singapore"],"countries":["SG"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":55000,"max_usd":128000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":17},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Linux","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Platform Engineering","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Sysmon","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-29T14:16:51Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-11-04T17:57:04Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"ROLE PURPOSE\nLead ST Engineering’s proactive, intelligence-led threat hunting services for enterprise, Operational Technology (OT) and Critical Information Infrastructure (CII) customers. Own the technical hunt lifecycle: threat intelligence → hypotheses → telemetry readiness → investigative queries → evidence validation → detection improvement → customer reporting and incident/DFIR escalation. This is a hands-on technical leadership role, not solely SOC alert triage or project coordination.\nKEY RESPONSIBILITIES\nThreat intelligence, hunt planning and methodology\nDefine risk-based hunt strategies, monthly/ad hoc hunt plans, testable hypotheses, coverage objectives and measurable outcomes using customer operating context, critical assets and threat exposure.\nAssess cyber threat intelligence, threat actors/campaigns, indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs); map hypotheses and observations to MITRE ATT&CK Enterprise and ATT&CK for ICS where relevant.\nTelemetry assessment and OT environment understanding\nIdentify necessary log sources and artefacts across Windows/Linux hosts, OT engineering workstations, HMIs, authentication, privileged access, security devices, applications and networks; identify monitoring and evidential blind spots.\nVerify log ingestion and data quality, including parsing, timestamps, event coverage, field mapping, retention and searchability; direct technical remediation with SIEM/platform engineers before interpreting hunt results.\nThreat investigation and detection engineering\nLead complex IOC-, TTP- and behaviour-driven hunts, perform SIEM correlation and investigative pivots, distinguish normal OT maintenance/administration from malicious activity, and assure evidence-backed conclusions.\nDevelop or review hunt analytics and detection use cases; coordinate testing, false-positive tuning and approved operational handover of SIEM/UEBA/EDR/XDR/SOAR detection improvements to SOC or detection engineering teams.\nFindings, customer communication and DFIR escalation\nReview findings, severity and confidence; present clear technical reports, recommended actions, telemetry limitations and senior-stakeholder briefings, with documented assumptions and evidence.\nEscalate credible malicious activity promptly via agreed customer and 24×7 SOC channels; coordinate handover to Incident Response/DFIR teams, preserving event timelines, affected assets, hunt logic and supporting evidence.\nSOC integration, service coordination and leadership\nWork closely with L1/L2/L3 SOC analysts operating 24×7×365, CTI, platform engineering, detection engineering and DFIR functions; establish escalation criteria, investigation handoffs and incident feedback loops.\nMentor hunters, review technical outputs, maintain procedures, hunting content and improvement backlog; provide workload forecasts and surge-support needs to the SOC/Service Delivery Manager for manpower planning.\nMINIMUM EDUCATION AND EXPERIENCE\nCybersecurity seniority: At least 7 years of relevant cybersecurity experience, including a minimum of 5 years in OT/ICS cybersecurity for engagements requiring that contractual threshold.\nSpecialist experience: At least 3 years of demonstrable hands-on threat hunting, advanced incident investigation/DFIR or detection engineering, including technical ownership of end-to-end hunts; experience in customer-facing technical delivery.\nCore technical skills: Strong working knowledge of cyber threat intelligence, ATT&CK, threat hypotheses, Windows/Linux and network artefacts, SIEM correlations, investigation techniques, query development and evidence interpretation.\n OT and security stack: Knowledge of OT/ICS assets and architecture, OT asset management, patch management, Privileged Access Management (PAM), SIEM, UEBA, EDR, XDR and SOAR, and their roles in security visibility and response.\n Service interfaces: Practical understanding of 24×7×365 SOC L1/L2/L3 operations, escalation pathways, surge prioritisation and secure customer communication. Hands-on experience with at least one SIEM query language (e.g. Elastic KQL/EQL, Splunk SPL or Microsoft Sentinel KQL).\nPROFESSIONAL CERTIFICATIONS\nRequired: Hold at least one relevant, recognised cybersecurity certification appropriate to OT security, threat hunting, intrusion investigation or incident response. Examples include GIAC GICSP, GRID, GCFA, GCIH, GCDA or GCTI; CREST Registered Intrusion Analyst (CRIA), Certified Incident Manager (CCIM) or Registered Threat Intelligence Analyst (CRTIA); or an equivalent qualification. The relevance, current status and any customer-mandated equivalence must be verified prior to assignment.\nPreferred: Complementary OT/ICS and investigation/detection qualifications (e.g. GICSP/GRID plus GCFA/GCDA/CRIA), CISSP or CISM for broader security leadership, and vendor-specific SIEM/EDR qualifications. A CTI-only or governance-only certificate does not substitute for proven hands-on hunting ability.\nPREFERRED CAPABILITIES\nExperience in critical infrastructure, transport, utilities, safety-sensitive or segmented/air-gapped OT environments; familiarity with operational restrictions on active testing and response.\nScripting for data transformation, triage and automation (Python/PowerShell); detection-as-code, Sigma, Sysmon, threat emulation and management of reusable hunt content.\nTECHNICAL SCREENING EXPECTATION\nCandidates should demonstrate a real intelligence-to-hunt case: threat trigger, customer relevance, hypothesis, required datasets/fields, parsing checks, representative query logic, evidence pivots, benign explanations, validated findings, detection enhancements and customer/DFIR escalation decision.\nWork location: Jurong East","description_format":"text","description_chars":5727,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Smart City","Incident Response","Defense Manufacturing","Maintenance, Repair & Operations (MRO)"],"lifecycle":[{"event":"open","at":"2026-10-29T14:16:51Z"}],"visa":[],"liveness":{"score":88,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.883,"p_room":1,"age_days":5,"expected_fill_days":17,"reasons":["conf:23","velocity","win:early","comp:brand"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/st-engineering-threat-hunter-lead","json_url":"https://alion.io/job/st-engineering-threat-hunter-lead.json","meta":{"generated_at":"2026-11-04T22:52:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1057,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1818473},"rest":"https://alion.io/mcp/rest/get_company?id=1818473"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fst-engineering-threat-hunter-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fst-engineering-threat-hunter-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fst-engineering-threat-hunter-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/st-engineering-threat-hunter-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fst-engineering-threat-hunter-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3462267}},{"tool":"search_jobs","arguments":{"company":"stengg.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3462267},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}