Assistant Director (Cloud Monitoring) - DIS

You oversee daily Security Operations Centre (SOC) operations involving threat detection, incident management in cloud environments, and supervise team training and development activities while coordinating with vendors and SAF System managers for SOC-related matters. Responsibilities - Assist the Section Head in building the team’s competency and expansion towards the direction of a Security Operation Centre (SOC) - Interact with external and internal stakeholders for discussion and coordination of system integration, project trials and system enhancements - Provide guidance and support during cyber incidents and escalations - Coordinate and assist with incident management efforts, including containment, remediation and recovery phases - Establish Key Performance Indicators (KPIs) for SOC’s exercises and subsequently evaluate individual and team competencies and performance during the exercises - Review Standard Operating Procedures (SOPs) to ensure alignment with evolving cyber threats and SAF policies - Promote a culture of knowledge sharing within the SOC team to enhance collective expertise - Formalise the documentation of past incident management cases and lessons learned for knowledge retention - Ensure SOC’s tools’ meet baseline requirements and are optimised - Stay informed about emerging cyber threats and evolving tool capabilities to collaborate with other stakeholders - Work with stakeholders to ensure the performance and resource utilisation of the SOC tools Challenge(s) - Striking the right balance between leadership and technical skills while also possessing the technical acumen to guide SOC operations - Managing resources, including staffing needs and the integration of complex SOC tools and systems - Responding rapidly to cyber incidents while maintaining composure and leading the team effectively during crisis situations. - Rotating with the section head for 24/7 monitoring duties Requirements - Education in Cybersecurity, Computer Engineering, Information Systems or an equivalent discipline - At least 6 years of working experience in cybersecurity roles, including a minimum of 2 years in a senior or supervisory roles within a SOC or Cyber Emergency Response Team - Relevant technical certification, e.g. GIAC Security Operations Certified (GSOC), GIAC Certified Incident Handler (GCIH), Certified Information Systems Security Professional (CISSP) and/or Certified Information System Manager (CISM)) - Proficiency in tools, e.g. Security Information and Event Management, Intrusion Detection System, Intrusion Prevention System, and Endpoint Detection and Response - Familiarity with Cloud Monitoring related tools such as SolarWinds, Azure Monitor, AWS Monitoring Only shortlisted candidates will be notified.