Client Security Lead

• Serve as the named technical security owner for a defined set of client accounts
• Own the effectiveness and continuous improvement of the MTDR service for assigned clients
• Act as the two-way technical interface between clients and Theos Defence’s SOC
• Maintain deep knowledge of client architecture, asset inventory, and strategic roadmap
• Lead monthly reviews covering events of interest and security posture enhancements
• Bring client context to SOC analysts and engineers and handle escalations
• Conduct hypothesis-driven threat hunts based on CTI, detection gaps, and ATT&CK-mapped attack paths
• Translate threat intelligence, indicators, and TTPs into actionable detection logic
• Audit, tune, prune, and improve detection rules to reduce alert noise
• Identify misconfigurations, AD risks, and broken baseline controls and help clients remediate them
• Investigate major incidents by correlating endpoint, identity, cloud, and network telemetry
• Construct incident timelines, blast-radius assessments, and root-cause analyses
• Support active compromise assessments and incident response engagements with environment context, hunting queries, and detection logic
• Perform investigation quality checks and mentor junior analysts
• Use analyst pain points to drive detection-engineering improvements

• Experience building, tuning, and retiring detection rules in major SIEM/XDR platforms
• Direct experience with Microsoft Sentinel or CrowdStrike Falcon is a plus
• Strong query fluency on another SIEM/XDR platform acceptable
• Ability to write non-trivial detection logic independently
• Ability to evaluate detection-rule trade-offs between alert fatigue and missed edge cases
• Experience in threat hunting or incident response
• Experience owning hunts and incidents from initial signal through root cause
• Ability to structure hunts around testable hypotheses and identify disconfirming evidence
• Ability to correlate endpoint, identity, cloud, and network logs to reconstruct timelines and blast radius
• Working knowledge of at least one major cloud/identity ecosystem: Microsoft Azure, Entra ID, M335, or AWS
• Ability to trace cloud audit and sign-in logs and map activity to endpoint activity
• Understanding of real-world cloud/identity attacks, including password spraying, consent phishing, and excessive permission abuse
• Ability to communicate with senior leadership, technical teams, and non-technical decision-makers
• Ability to write crisp, professional client-facing documentation
• Ability to quickly map unfamiliar technical environments and maintain an updated mental model
• Multi-account MSSP/consulting experience is a plus, not required
• Formal incident response or compromise assessment background is a plus, not required
• Python or PowerShell skills are a plus, not required
• Practical understanding of AI/AI Agent security risks and novel attack vectors is a plus, not required
• Familiarity with Asia-Pacific threat actors, TTPs, and sector risks is a plus, not required

• Continuous Development of People
• Remote work arrangement
• Premium Security Services environment
• Full-time employment