Senior Lead SOC Incident Responder & Security Incident Manager

About the role

The NETS Group, a payments services group operating Singapore's national debit scheme, is hiring a Senior Lead SOC Incident Responder and Security Incident Manager in Braddell. The role leads end-to-end incident response, acts as Incident Commander during major security events, and drives incident management processes, playbooks and readiness.

Key responsibilities

• Lead incident response from detection through recovery, investigating endpoints, networks, identity, cloud and applications, and handling APT, ransomware and fraud-related attacks
• Act as Incident Commander, coordinate cross-functional teams, and lead post-incident reviews with remediation tracked to closure
• Serve as the highest technical escalation point in the SOC and support analysts on high-priority alerts
• Develop and maintain incident response playbooks and runbooks, align them with frameworks such as MAS TRMG, CCoP, NIST and ISO 27035, and run tabletop exercises
• Use threat intelligence to improve detection and give feedback to detection engineering and threat hunting teams
• Oversee forensic data acquisition and analysis (disk, memory, logs) and ensure proper chain of custody
• Drive automation and SOAR playbooks, recommend tools, and liaise with Fraud, Risk, Compliance and IT while supporting regulatory reporting

Required profile

• 10-15+ years of cybersecurity experience, including 5+ in incident response, digital forensics or SOC operations and 3+ in a lead or incident management capacity
• Crisis management and incident command experience, and cross-functional coordination under pressure
• Preferred: financial services, payments or critical infrastructure background, malware analysis and reverse engineering, and exposure to fraud-related incidents

Required skills

• Incident response methodologies, EDR/XDR and SIEM platforms, network and endpoint investigation
• TTPs, MITRE ATT&CK, malware behavior and OS internals (Windows/Linux)
• Preferred: cloud security incident response (AWS, Azure, GCP), identity-based attacks, and GIAC, CISSP, CISM or vendor certifications