Associate Principal, Cyber Threat Intelligence Analyst

This is a fully remote position, open to applicants in Singapore.

📋 Description

• Provide direct support to the client with their ICS/OT cyber threat intelligence requirements, particularly during critical situations related to national security.

• Conduct research, analysis, and threat hunting in the ICS/OT domain utilizing both proprietary and commercial resources, including exploratory and hypothesis-driven investigations.

• Examine network traffic and industrial protocols to identify unusual behavior.

• Establish baseline behaviors for OT assets and networks throughout Singapore's critical infrastructure using the Dragos Platform, Synapse, and other complementary tools.

• Contextualize threats and risks in the ICS/OT landscape, offer guidance on best practices and mitigations, and cultivate expertise in threats specific to the client's operational technology environment.

• Convert technical hunting outcomes into MITRE ATT&CK for ICS mappings and confidence-based evaluations.

• Assist the client during incident response activities and exercises.

• Create industry-centric technical and strategic ICS/OT CTI content, providing constructive feedback to internal Dragos teams.

⛳️ Requirements

• Applicants must be Singapore citizens and possess an active Security Clearance.

• A minimum of 4 years of experience in cyber threat intelligence, utilizing various data sources (e.g., NetFlow, open-source intelligence, SIEMs, malware repositories) to create analytical products.

• Practical experience in threat hunting, including packet capture analysis and inspection of industrial protocols.

• Strong hands-on knowledge of both freeform and hypothesis-driven methodologies for threat hunting.

• Experience in a customer-facing role, demonstrating the ability to manage stakeholders independently and effectively.

• Excellent technical and strategic writing skills for producing CTI analysis products, including confidence-based assessments and threat modeling frameworks like the Diamond Model of Intrusion Analysis.

• Proficiency in data aggregation, hunting, and analysis tools (e.g., Synapse), along with experience in utilizing AI/LLM resources within CTI workflows.

• Extensive understanding of ICS/OT threats across various industrial sectors, including adversary TTPs, historical attack patterns, PLCs, HMIs, RTUs, network protocols, and topologies.

• Capability to independently define, develop, and deliver CTI analysis using MITRE ATT&CK for ICS, D3FEND, and the ICS Cyber Kill Chain.

🏝️ Benefits

• Competitive Equity Package

• Comprehensive Benefits Plan