Senior Detection Engineer, Director (Assistant VP)

About the role

Morgan Stanley's Threat Hunt and Cybersecurity Defense (THCD) team is looking for an experienced detection engineer with strong cyber technical skills, Python development experience, and depth in either adversary infrastructure hunting or malware analysis and reverse engineering. The role is a Director-level Cybersecurity Engineer position in the Technology division, based in Singapore, focused on protecting the firm's network against attacks.

Key responsibilities

• Design, develop, test, tune and maintain detection logic across endpoint, network, identity, application and other enterprise telemetry sources.
• Hunt for adversary infrastructure, tooling, command-and-control patterns, phishing and staging infrastructure, and abuse of legitimate services.
• Translate findings from infrastructure hunting, malware analysis and reverse engineering into detection strategies and coverage.
• Use Python to automate analysis, enrich security data, build investigative workflows and integrate with internal and external APIs.
• Build and maintain tooling that helps analysts and engineers process large data sets and speed up investigations.
• Analyze telemetry and suspicious activity to understand attacker behavior, validate detections and recommend improvements.
• Work with threat intelligence, incident response and purple team stakeholders to turn findings into detections and proactive surveillance.
• Research emerging adversary tradecraft and malware behaviors, and mentor junior team members through code reviews, documentation and knowledge sharing.

Required profile

• At least 7 years of hands-on experience in detection engineering, threat hunting, security engineering, incident response, blue teaming, malware analysis and reverse engineering or a related field.
• Demonstrated experience in at least one of: adversary infrastructure hunting, malware analysis and reverse engineering, C2 or phishing infrastructure analysis, botnet hunting, tooling fingerprinting or abuse of legitimate services.
• Strong cyber technical knowledge of adversary TTPs, post-exploitation, malware patterns, identity abuse, endpoint and network behavior, and security telemetry.
• Ability to turn technical findings into detection logic, surveillance strategies or automated analysis, and to communicate technical findings to technical and non-technical stakeholders.

Required skills

• Strong Python development skills, including API work, data processing, workflow automation and tool building.
• Experience building automation and tooling for security analysis, threat hunting and detection engineering.
• Understanding of detection engineering concepts such as rule tuning, coverage analysis, false-positive reduction and detection validation.
• Experience analyzing large volumes of security data, logs, alerts, indicators and telemetry.

Exposure to adversary emulation, purple-team exercises, red-team collaboration, dashboard and notebook design, and cybersecurity certifications are useful but not required.