Vice President, Threat Detection Engineer

About the role

SGX Group is looking for a Vice President to lead and enhance its cyber‑threat detection capabilities across the exchange’s technology landscape. The Threat Detection Engineer will design, develop, tune and maintain detection rules, analytics and automation to identify malicious activity, reduce false positives and enable rapid incident response.

Key responsibilities

• Design, develop and maintain detection use cases and rules for SIEM, EDR, NDR, cloud security and other platforms, mapping them to MITRE ATT&CK and MITRE ATLAS techniques.
• Continuously tune detections to improve effectiveness, reduce false positives and close monitoring gaps.
• Translate threat intelligence and emerging attack trends into actionable detection content and behavioral analytics.
• Collaborate with SOC, Incident Response, Threat Intelligence, engineering and cloud teams to integrate detection logic and automate enrichment, triage and response via SOAR platforms.
• Conduct adversary emulation, purple‑team exercises and attack simulations to validate detection coverage and measure effectiveness.
• Drive process, documentation and workflow improvements for detection operations and tool integrations (e.g., ticketing, CMDB).

Required profile

• 10‑15 years of relevant experience, preferably in financial services or asset management, with at least 5 years focused on cybersecurity platforms.
• Deep knowledge of information security policies, MAS technology risk guidelines and industry frameworks such as NIST and MITRE ATT&CK.
• Proven ability to work with senior stakeholders, manage internal and external customers and operate in fast‑paced, multicultural environments.
• Strong analytical, meticulous and self‑initiated mindset with excellent communication and presentation skills.

Required skills

• Security tools: SIEM, EDR, NDR, XDR, SOAR, email security, vulnerability management, cloud security platforms.
• Detection engineering: rule development, behavioral analytics, anomaly detection, threat hunting, adversary emulation.
• Frameworks & standards: MITRE ATT&CK, MITRE ATLAS, NIST, MAS Technology Risk Management Guidelines.
• Automation & integration: SOAR workflow design, integration with ticketing systems, CMDB, and other security controls.