Senior Detection Engineer, Director (Assistant VP)
Marks & Spencer Group plc2 months ago
Singapore, SingaporeStaff+
Responsibilities
- Design, develop, test, tune, and maintain detection logic across endpoint, network, identity, application, and enterprise telemetry sources.
- Hunt adversary infrastructure, tooling, command-and-control patterns, phishing infrastructure, staging infrastructure, and attacker abuse of legitimate services.
- Translate threat hunting, malware analysis, reverse engineering, and investigative findings into scalable detection strategies and proactive surveillance capabilities.
- Use Python to automate analysis, enrich security data, integrate APIs, and build investigative workflows and security tooling.
- Build and maintain tools for processing large datasets, identifying infrastructure and tooling patterns, validating detection ideas, and accelerating investigations.
- Analyze security telemetry and suspicious activity to understand attacker behavior, validate detection quality, identify coverage gaps, and recommend improvements.
- Collaborate with threat intelligence, incident response, and purple-team stakeholders on high-fidelity detections and threat-informed defense.
- Provide technical guidance to junior team members through reviews, investigation support, documentation, and knowledge sharing.
Requirements
- At least 7 years of related hands-on experience in detection engineering, threat hunting, security engineering, incident response, blue teaming, malware analysis and reverse engineering, security operations engineering, or a related cybersecurity field.
- Strong knowledge of adversary tactics, techniques, and procedures, enterprise attack paths, post-exploitation behavior, malware, command-and-control patterns, identity abuse, endpoint activity, network behavior, and security telemetry.
- Demonstrated experience in adversary infrastructure hunting, malware analysis and reverse engineering, command-and-control infrastructure analysis, phishing infrastructure analysis, botnet infrastructure hunting, tooling fingerprinting, or attacker abuse of legitimate services.
- Strong Python development skills, including maintainable code, API integration, structured and unstructured data processing, workflow automation, troubleshooting, and tool development.
- Practical experience building automation or tooling for security analysis, detection engineering, threat hunting, incident investigation, data enrichment, infrastructure hunting, reverse engineering workflows, or operational efficiency.
- Experience analyzing large volumes of security data, logs, alerts, indicators, telemetry, infrastructure patterns, or tool behaviors.
- Strong understanding of detection design, rule tuning, alert quality, coverage analysis, false-positive reduction, detection validation, and lifecycle management.
- Ability to convert technical findings and stakeholder requirements into detection logic, hunting opportunities, surveillance strategies, and practical technical solutions.
- Strong written and verbal communication skills for explaining technical findings, detection logic, and engineering tradeoffs to technical and non-technical stakeholders.
- Preferred qualifications include exposure to adversary emulation, purple-team exercises, red-team collaboration, threat-informed defense, security dashboards, notebooks, data pipelines, enrichment services, internal analyst tools, or relevant cybersecurity certifications.
Benefits
- Comprehensive employee benefits and perks supporting employees and their families throughout their work-life journey.
- Opportunity to work with collaborative teams and pursue internal mobility across the business.
- The position is based with the global team in Singapore.
- Morgan Stanley is committed to diversity, inclusion, equal opportunity, and employee development.
About Marks & Spencer Group plc
Marks & Spencer Group plc is a British retailer selling clothing, home goods, and food to consumers through stores and ecommerce, with a focus on own-brand products. The company is listed on the London Stock Exchange, was founded in 1884, and is headquartered in London. In the UK, its online grocery offering runs via Ocado Retail, a joint venture in which M&S holds a significant stake.