Key responsibilities:
- Monitor the cyber threat landscape and evaluate the organisation's security posture to recommend and implement appropriate detection and response measures.
- Examine security indicators (for example, indicators of compromise and indicators of attack) and dissect the tactics, techniques and procedures (TTPs) used by threat groups to ensure SOC coverage for anomaly detection and prevention.
- Carry out intelligence-led analysis and investigations to identify likely threat actors and their attack methodologies; support root cause analysis and advise on remediation.
- Perform proactive threat hunting across the environment to locate assets or behaviours that could be exploited in future attacks.
- Work closely with internal teams and external partners to build effective relationships that support intelligence sharing and security initiatives.
- Support the vulnerability management lifecycle for assets and networks, including prioritisation and the integration of vulnerability intelligence into SOC workflows.
- Contribute to continuous improvement of SOC processes by supporting gap analyses and implementing automation and operational improvements.
- Provide clear, actionable technical and non-technical reports and briefings to stakeholders across functions.
Qualifications and experience:
- Bachelor's degree in Computer Science, Information Technology or a related discipline.
- Relevant professional cybersecurity certifications such as CISSP, CISM, CISA, GCTI, CTIA or equivalent.
- Minimum 3 years' experience in a cybersecurity role, including at least one year in security operations with hands-on intelligence work.
- Strong knowledge of cyber threats, vulnerabilities, attack lifecycles, intelligence and incident response processes.
- Familiarity with Cyber Kill Chains, the MITRE ATT&CK framework or comparable standards.
- Experience with cybersecurity tools and open-source intelligence (OSINT) capabilities.
- Strong organisational, collaboration and interpersonal skills for engaging stakeholders and delivering intelligence products.
- Proven ability to prepare and communicate both technical and non-technical reports and briefings.
- Willingness to work outside normal hours to respond to critical incidents and emerging threats.
- Knowledge of Operational Technology (OT) and Artificial Intelligence (AI) is a significant advantage.
- Proficiency in written and spoken English and Chinese. Mandarin speaking capacity would be an advantage.
