Lead Cybersecurity Incident Response Specialist

About the role

GovTech, Singapore's lead agency for Smart Nation and public sector digital transformation, is hiring a Cybersecurity Operations Specialist (Incident Response) within its Cyber Defense Ops & Intelligence unit. You will join the Cyber Incident Response Team (CIRT) and manage and investigate cybersecurity incidents, covering triage, investigation and advice on containment, eradication and recovery.

Key responsibilities

• Triage and investigate potential cybersecurity incidents to determine scope and severity
• Develop and execute containment strategies
• Perform root cause analysis to identify attack vectors, tactics and impact
• Analyse security event logs across endpoints, EDR, network traffic, applications, cloud services and audit trails
• Conduct digital forensic acquisition and analysis of artifacts from endpoints, servers, network devices, cloud environments, mobile devices and storage media
• Maintain stakeholder communication and write post-incident reports with preventive recommendations
• Support automation of Security Operations, such as implementing SOAR playbooks, and develop and test incident response playbooks
• Stay aware of the cyber security landscape and emerging threat actor TTPs

Required profile

• Bachelor's degree in Computer Science, Information Security or equivalent
• Professional certifications such as GCFA, GREM, GNFA, GCTI or CISSP preferred
• Preferably 5 years or more of experience as an incident responder, digital forensics analyst, malware analyst or in a related discipline
• Good communication, critical thinking and teamwork skills, with integrity and initiative

Required skills

• Log analysis and digital forensics; familiarity with Splunk, ELK Stack and Google SecOps
• Forensic tools such as AXIOM, FTK or Autopsy
• Basic static and dynamic malware analysis and network/application log analysis
• Knowledge of Windows and Linux, LAN and server networking; cloud and container technologies are a plus