Senior Lead SOC Incident Responder & Security Incident Manager

The NETS Group is a leading payments services group, enabling digital payments for merchants, consumers and banks across the entire payments value chain. 
 

The Group operates Singapore’s national debit scheme enabling customers of DBS Bank/POSB, HSBC, Maybank, OCBC Bank, Standard Chartered Bank and UOB to make payments using their ATM cards or mobile devices at more than 130,000 acceptance points in the country as well as online payments.

Key Responsibilities

Incident Response & Investigation

Lead and conduct end-to-end incident response across detection, triage, containment, eradication, and recovery.

Able to perform deep technical investigations across endpoints, network, identity, cloud, and application layers.

Analyze malware, attacker behaviors, and intrusion patterns to determine root cause and attack scope.

Handle high-severity and sophisticated cyber incidents, including APT, ransomware, and fraud-related attacks.

Maintain detailed documentation of incidents, actions taken, and lessons learned.

Security Incident Management

Act as Incident Commander during major security incidents, coordinating cross-functional teams (SOC, IR, IT, Legal, Risk, Communications).

Drive structured incident management processes, ensuring adherence to SLAs and playbooks.

Provide timely and clear communications to senior management and stakeholders.

Lead post-incident reviews (PIRs) and ensure remediation actions are tracked to closure.

SOC Operations & Escalation

Serve as the highest technical escalation point within SOC for complex investigations.

Support SOC analysts in triage and response for high-priority alerts.

Improve escalation processes and decision-making frameworks during incidents.

Playbooks, Processes & Readiness

Develop, maintain, and continuously improve incident response playbooks and runbooks.

Ensure readiness for various threat scenarios including ransomware, data exfiltration, and insider threats.

Conduct and support tabletop exercises and incident simulations.

Align incident response processes with industry frameworks (e.g., MAS TRMG, CCoP, NIST, ISO 27035).

Threat Intelligence & Detection Feedback Loop

Leverage threat intelligence to enhance incident response effectiveness.

Provide feedback to detection engineering and threat hunting teams to improve use cases and monitoring coverage.

Identify detection gaps exposed during incidents and drive remediation.

Digital Forensics & Evidence Handling

Perform or oversee forensic data acquisition and analysis (disk, memory, logs).

Ensure proper chain of custody and evidence handling for legal and regulatory needs.

Support investigations that may require regulatory reporting or legal actions.

Automation & Tooling

Drive the use of automation and SOAR playbooks to accelerate response actions.

Recommend and implement tools to improve investigation speed and accuracy.

Stakeholder & Regulatory Engagement

Liaise with internal stakeholders including Fraud, Risk, Compliance, and IT.

Support regulatory incident reporting requirements relevant to financial/payment systems.

Act as a trusted advisor during cyber crisis situations.

Required Qualifications & Experience

10–15+ years of cybersecurity experience, with:

5+ years in incident response / digital forensics / SOC operations

3+ years in a lead or incident management capacity

Strong hands-on experience in:

Incident response methodologies and frameworks

EDR/XDR platforms

SIEM platforms 

Network and endpoint investigation techniques

Deep understanding of:

Threat actor tactics, techniques, and procedures (TTPs)

MITRE ATT&CK framework

Malware behavior and attack lifecycle

Experience in:

Crisis management and incident command

Cross-functional coordination during high-pressure scenarios

Strong technical skills in:

OS internals (Windows/Linux)

Networking (TCP/IP, DNS, HTTP/S, etc.)

Log analysis and correlation

Preferred Qualifications

Experience in financial services, payments, or critical infrastructure environments

Hands-on malware analysis and reverse engineering (basic to advanced)

Familiarity with:

Cloud security incident response (AWS, Azure, GCP)

Identity-based attacks and investigations

Exposure to fraud-related cybersecurity incidents

Preferred Certifications

GIAC certifications (GCFA, GCIH, GNFA, GREM)

CISSP, CISM

Certified Incident Handler / Forensics certifications

Vendor certifications (Microsoft, CrowdStrike, Google Mandiant, Elastic, etc.)

Key Competencies

Strong technical depth and investigative skills

Ability to lead during high-pressure incidents

Excellent communication and stakeholder management

Structured and analytical thinking

Decisiveness and accountability

Mentorship and team leadership

What Success Looks Like

Rapid and effective containment of high-impact security incidents

Reduced MTTR (Mean Time to Respond) and improved response quality

Well-executed and coordinated incident management processes

Continuous improvement of IR playbooks and readiness

Strong trust and confidence from executive leadership and stakeholders

Network for Electronic Transfers (Singapore) Pte Ltd.