AVP, Cyber Security Engineer, Information Security Services, Group Technology

Job description

Business Function Group Technology enables and empowers the bank with an efficient, agile, and resilient technology infrastructure through a strategic focus on productivity, quality, control, people capability, and innovation. We manage and secure the Bank's core technology platforms while delivering trusted and innovative services that support the Bank's business objectives across the region. Responsibilities Serve as the Subject Matter Expert (SME) for the Bank's Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA) platforms, ensuring high availability, performance, and operational effectiveness. Design, develop, implement, and maintain security monitoring use cases, correlation rules, behavioral analytics policies, alerts, dashboards, and reporting capabilities. Lead the onboarding, normalization, enrichment, and quality assurance of logs from endpoints, servers, applications, network devices, identity platforms, and cloud environments. Collaborate with Security Operations Center (SOC), Cyber Defense, Infrastructure, Cloud, and Application teams to improve monitoring coverage and detection capabilities across the enterprise. Develop, tune, and optimize SIEM correlation rules, UEBA models, and detection content to improve alert fidelity, reduce false positives, and strengthen security visibility. Manage and enhance UEBA capabilities to identify anomalous user and entity activities, support insider risk monitoring, detect account compromise indicators, and improve visibility of privileged access activities. Support security investigations by providing expertise in log analysis, event correlation, user activity monitoring, and behavioral analytics. Perform log source governance and reconciliation activities, including verification of log onboarding status, monitoring log collection health, validating data completeness, and ensuring security events are accurately and consistently ingested into SIEM and UEBA platforms. Work closely with infrastructure, cloud, network, application, and security teams to track technology changes, identify gaps in logging coverage, and reconcile log source inventories against enterprise asset inventories and security monitoring requirements. Establish and maintain processes, metrics, and reporting to ensure system onboarding, decommissioning, and configuration changes are accurately reflected within the security monitoring environment. Lead SIEM and UEBA platform initiatives, including upgrades, architecture enhancements, technology integrations, automation, and service improvement projects. Drive operational efficiency through process optimization, workflow automation, and continuous enhancement of monitoring capabilities. Stay abreast of emerging technologies, cybersecurity trends, and security monitoring best practices to continuously improve service delivery. Develop and maintain operational documentation, standards, procedures, and knowledge repositories for SIEM, UEBA, and security monitoring services. Provide technical leadership and advisory support to stakeholders on logging strategies, monitoring requirements, security analytics, and detection capabilities. Requirements Degree in Computer Science, Information Security, Engineering, or a related discipline. Experience implementing, engineering, or administering enterprise SIEM and/or UEBA platforms such as Microsoft Sentinel, Splunk Enterprise Security, Exabeam, Securonix, IBM QRadar, ArcSight, LogRhythm, or equivalent technologies. Strong understanding of SIEM architecture, log management, event correlation, security analytics, and UEBA concepts. Hands-on experience developing and tuning detection rules, correlation searches, behavioral analytics policies, dashboards, alerts, and monitoring use cases. Experience onboarding and integrating data sources from Windows, Linux/Unix, Active Directory, Microsoft Entra ID, cloud platforms, network devices, endpoints, and security solutions. Experience in log source onboarding, log lifecycle management, asset-to-log reconciliation, data quality validation, and monitoring coverage assessments. Understanding of identity-based security risks, privileged access monitoring, insider risk indicators, account compromise scenarios, and anomalous user behavior analysis. Experience with scripting and automation technologies such as PowerShell, Python, Kusto Query Language (KQL), Splunk SPL, or equivalent query languages. Familiarity with MITRE ATT&CK framework and security monitoring best practices. Experience with SOAR technologies, security orchestration, automation, and workflow integration will be an advantage. Relevant certifications such as CISSP, CISM, GIAC, Microsoft SC-200, SC-100, Splunk Security Certifications, Exabeam, Securonix, or equivalent certifications would be advantageous. Strong analytical and problem-solving skills with the ability to troubleshoot complex security monitoring, logging, and data ingestion issues. Excellent communication, stakeholder management, and documentation skills. Self-motivated with the ability to work independently in a dynamic and fast-paced environment. Preferred Experience Experience supporting large-scale enterprise security monitoring environments within highly regulated industries such as banking or financial services. Experience managing security monitoring coverage, log governance processes, and regulatory or audit-driven logging requirements. Experience with cloud-native security monitoring and analytics across Microsoft Azure, AWS, and GCP environments. Apply Now We offer a competitive salary and benefits package, together with the opportunity to work in a dynamic and collaborative environment that supports professional growth, innovation, and continuous learning. Join us in strengthening the Bank's cyber resilience through advanced security monitoring, analytics, and detection capabilities. Location: DBS Asia Hub Job: Technology Schedule: Regular Employee Status: Full time