AVP, Cyber Security Engineer - SIEM & UEBA

About the role

DBS Group Technology is looking for an AVP Cyber Security Engineer to act as Subject Matter Expert for its Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA) platforms. The role covers design, development, maintenance and governance of security monitoring, detection and reporting, working with SOC, Cyber Defense, Infrastructure, Cloud and Application teams. The position is based at the DBS Asia Hub and is full time.

Key responsibilities

• Serve as SME for SIEM and UEBA platforms, keeping them available, performant and effective.
• Design, build and maintain monitoring use cases, correlation rules, behavioral analytics policies, alerts, dashboards and reports.
• Lead onboarding, normalization, enrichment and quality checks of logs from endpoints, servers, applications, network devices, identity platforms and cloud environments.
• Work with SOC, Cyber Defense, Infrastructure, Cloud and Application teams to improve monitoring coverage and detection.
• Tune SIEM correlation rules, UEBA models and detection content to reduce false positives and improve alert fidelity.
• Manage UEBA to spot anomalous user and entity activity, insider risk, account compromise and privileged access abuse.
• Support investigations with log analysis, event correlation and behavioral analytics expertise.
• Run log source governance and reconciliation, verify log onboarding, monitor collection health and validate data completeness.
• Track technology changes, close logging gaps and reconcile log inventories with asset inventories.
• Set up processes, metrics and reporting for onboarding, decommissioning and configuration changes.
• Lead SIEM and UEBA initiatives such as upgrades, integrations, automation and service improvements.
• Maintain documentation, standards, procedures and knowledge repositories, and advise stakeholders on logging and detection strategies.

Required profile

• Degree in Computer Science, Information Security, Engineering or a related discipline.
• Hands-on experience implementing, engineering or administering enterprise SIEM and/or UEBA platforms such as Microsoft Sentinel, Splunk Enterprise Security, Exabeam, Securonix, IBM QRadar, ArcSight or LogRhythm.
• Experience onboarding data sources from Windows, Linux/Unix, Active Directory, Microsoft Entra ID, cloud platforms, network devices and endpoints.
• Experience with log lifecycle management, asset-to-log reconciliation and data quality validation.
• Understanding of identity-based security risks, privileged access monitoring, insider risk and account compromise scenarios.
• Strong analytical, problem-solving, communication and documentation skills, able to work independently in a fast-paced environment.

Required skills

• Scripting and automation tools such as PowerShell, Python, KQL or Splunk SPL.
• Familiarity with MITRE ATT&CK and security monitoring best practices.
• SOAR experience is an advantage; cloud-native monitoring on Azure, AWS and GCP is preferred.
• Certifications such as CISSP, CISM, GIAC, Microsoft SC-200/SC-100 or Splunk security certifications are advantageous.