Cyber Defense Officer

Tasks

• Security Operations (L1/L2):
  • Conducting continuous security monitoring, triage, and detailed analysis of security incidents using SIEM tools
  • Cyber Level 1 (L1) and Level 2 (L2) incident response activities, from initial detection, containment, remediation, and recovery, to ensure timely resolution and risk mitigation
  • Monitoring, investigating, and tracking security incidents to ensure timely resolution, as well as maintaining comprehensive documentation and case management throughout the entire incident lifecycle
• Cyber Threat Intelligence (CTI):
  • Identification of cyber threats, such as critical vulnerabilities relevant to the bank, and assessment of their impact
  • Conducting proactive threat hunting activities to search for specific Indicators of Compromise (IOCs) or tactics, techniques, and procedures
  • Collecting and analyzing information from internal networks and external sources to predict and proactively address threats
  • Support in evaluating detective and protective security controls to detect and mitigate attacks on the bank's IT infrastructure
• Other Cyber Defense Responsibilities:
  • Assistance with cyber investigations as needed, including the operation of relevant forensic tools
  • Support for the engineering stream in automated attack simulation testing
  • Support the engineering team in the development and maintenance of detections, where applicable
  • Support with project implementation, where applicable
  • Supporting internal and external audits by coordinating reviews, facilitating the collection of evidence, and providing relevant risk assessments and analyses
• As part of the bank’s risk management function, the individual must work closely with IT, Corporate Services, or other relevant functions, along with the Head of the Cyber Fusion Center Asia, to identify, mitigate, and appropriately address cyber risks

Requirements

• Personal and social:
  • Strong interpersonal, communication, and presentation skills
  • Self-motivated and able to work independently to drive initiatives and tasks forward
• Professional and technical:
  • Bachelor's degree in information security, computer science, computer engineering, or a related field
  • Previous experience in Level 1 and Level 2 security operations, threat analysis, and incident response is a plus
  • Strong expertise in cybersecurity operations with hands-on experience in SIEM tools and platforms, GUI development, and dashboarding
  • Strong programming and scripting skills (e.g., Python) for automation and custom workflows
  • Experience with artificial intelligence, particularly generative AI, is a plus
  • Professional certification in information security (e.g., Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM)) and knowledge of risk frameworks such as MITRE ATT&CK are a plus but not required