AI Cyber Defence Specialist

About the role

ALEPH (formerly RED ALPHA CYBERSECURITY) is seeking an AI Cyber Defence Specialist to lead the organisation's threat management across Security Operations, Vulnerability Management, Threat Hunting and DFIR, reporting to the CISO Office. The role ensures capabilities are intelligence-led, measurable and aligned with regulatory and industry expectations such as the Cybersecurity Act and the Cybersecurity Code of Practice.

Key responsibilities

• Lead and manage 24x7 SOC operations, including MSSP or MDR partners, so events are monitored, triaged, escalated and resolved within SLAs
• Own the SOC operating model (tiered analysts, shifts, playbooks, runbooks, escalation matrix) and improve SOC maturity with AI
• Drive detection engineering across SIEM, EDR/XDR, identity and cloud-native tools, developing and tuning MITRE ATT&CK use cases
• Ensure log coverage across endpoints, servers and networks, and oversee SOAR automation
• Define and report SOC KPIs and KRIs (MTTD, MTTR, ATT&CK coverage, SLA adherence) to the CISO
• Lead response to zero-day and emerging vulnerabilities, including exposure assessment, compensating controls and emergency patching
• Run a hypothesis-driven threat hunting programme and turn findings into improved detections
• Gather threat intelligence from commercial, government and open sources, ingest IOCs and manage the TIP
• Act as incident responder, coordinating containment, eradication and recovery with internal teams and partners
• Manage MSSP/MDR, IR retainer and tooling vendors, and plan and manage the cyber defence budget
• Present the threat landscape and incident trends to the CISO, support audits and inspections, and coordinate stakeholder communication during incidents

Required profile

• Degree in Computer Science, Information Technology, Cybersecurity or a related discipline
• At least 5 years of cybersecurity experience, including 3 years leading a team
• Proven track record of leading responses to major incidents (ransomware, targeted intrusions, data breaches)
• Willingness to be on call during major incidents
• Analytical, detail-oriented, able to work independently under pressure

Required skills

• SIEM (Elastic, Microsoft Sentinel, Google SecOps, QRadar), EDR/XDR (CrowdStrike, Microsoft Defender, Trendmicro, Trellix) and SOAR platforms
• Vulnerability management (e.g. Tenable Nessus) and risk-based prioritisation
• Certifications and knowledge of MITRE ATT&CK, CIS Controls v8.1, ISO/IEC 27001:2022, Cybersecurity Act and PDPA
• Familiarity with AI-enabled security operations and threats targeting AI/LLM workloads