Proactive external threat hunting

• Spearhead operational and strategic intelligence work• Identify emerging threats in security industry, geopolitical, transnational, economic and global events which may be of potential impact• Strengthen threat detection by crafting SNORT signatures• Automate threat monitoring by developing SPLUNK rules and dashboards• Perform triage analysis on alerts through playbooks• Proactive research on open source intelligence (OSINT), to explains actionable threat intelligence beyond vendor feeds• Perform technical pivoting to investigate and uncover leads on IOCs using various OSINT tools (e.g. YARA, pDNS, registrant info)• Perform dynamic analysis of malware samples obtain in OSINT to generate latest IOCs• Produce tactical intelligence reports and advisories to management and industry partners (e.g. NUH)• Collaborate with other teams to integrate and automate threat intelligence with security tools• Act as part of incident response team where appropriate and provide operational cyber intelligence support during ongoing incidents• Project lead and liaise with vendor on compromise assessment for NUS’ infrastructure

• Automate open source intelligence (OSINT) from various cyber threat intelligence (CTI) feeds into Threat Intelligence Platforms (TIP) to keep abreast of latest developme on cyber threats• Construct YARA rules to obtain malware samples for investigation• Perform dynamic analysis of malwares to generate indicators of compromise (IOCs)• Analyse packet capture (pcap) via Wireshark to identify malicious traffic communications• Develop leads on adversaries IOCs through OSINT research (eg.: pDNS, registrant information)• Construct SNORT rules into Intrusion Detection System (IDS) to detect malicious events• Automate validation of threat events• Construct dashboards and alerts in SIEM (Splunk) to ease monitoring of threat events• Identify adversary’s threat landscape through analyzing threat detection events, OSINT and CTI reports• Provide first-cut analysis of cyber threat detection alerts• Collaborate with industry partners to provide practical and actionable intelligence• Educate management of adversary's threat level through threat landscape• Initiate new cyber threat detection and analytic technologies to improve existing systems and processes

• Tracked latest infocomm technology developments and leverage opportunities arising from technology advances to develop innovative concepts that derive a strategic advantage• Conducted requirement analysis to translate operational requirements into technical specifications to drive capability developments• Researched on communication patterns to detect and investigate anomalous behaviours• Identified information in communication protocols that addresses strategic needs• Developed modules for structured/unstructured data to enhance analysis of information• Translated R&D findings to proof-of-concepts to demonstrate operational values• Developed, adapted and integrated systems and application software to meet operational needs

• Conducted system performance analysis to ensure optimal performance of large scale infocomm systems• Developed operational metrics, prepare and deliver performance reporting to management• Initiated and oversaw capability development plans to improve existing systems and processes• Leveraged opportunities arising from technology advances to develop innovative concepts that derive a strategic advantage• Exploited and harnessed technologies across different domains to constantly add value to project outcomes

• Gathered user requirements, design system architecture and prepared technical documentation• Negotiated with vendors on product specifications and cost• Conducted user acceptance tests (UAT) to ensure deliverables adhere to contractual specifications• Integrated procured products into exisiting system seamlessly• Executed system deployment on-site and resolved troubleshooting issues