Detection Engineer, AssociateDirector (Assistant VP)

Threat Hunt and Cyber Detection (THCD) is looking for a detection engineer with a threat hunting mindset to join our global team in Singapore. The THCD mission is to seek out attacks against the Morgan Stanley network engineer high-quality detection strategies and reduce risk to Morgan Stanley assets. As a Threat Hunt team member you will focus on developing and maintaining detections analyzing adversary behavior improving security telemetry and enhancing bespoke tools used to defend the Morgan Stanley network.

In the Technology division we leverage innovation to build the connections and capabilities that power our Firm enabling our clients and colleagues to redefine markets and shape the future of our communities.

Since 1935 Morgan Stanley has been known as a global leader in financial services always evolving and innovating to better serve our clients and our communities in more than 40 countries around the world.

At Morgan Stanley Singapore we serve as the Firms Southeast Asia headquarters and regional hub supporting Morgan Stanleys businesses across the region. Morgan Stanley has had a presence in Singapore since 1990 and our Singapore office provides capabilities across investment banking equity and fixed income research securities trading derivatives commodities private wealth management and investment management. Located at IOI Central Boulevard Towers in downtown Singapore our Southeast Asia headquarters provides a world-class work environment advanced technology infrastructure and collaborative facilities that help our teams deliver best-in-class services and solutions for clients. Everyone is encouraged to chart their own meaningful career and achieve goals with the support of our training development and global collaboration opportunities.

What youll do in the role:

• Develop test tune and maintain detection logic to identify suspicious activity across endpoint network identity application and other enterprise telemetry sources.

• Translate adversary behaviors threat intelligence and hunt hypotheses into practical detection strategies and measurable detection coverage.

• Use Python to build automation parse and enrich security data support detection engineering workflows and improve bespoke threat hunting and detection tools.

• Work with technologies such as Sigma YARA ElasticSearch Git Python and related security analytics platforms to create and maintain detection content.

• Investigate security signals and suspicious activity to understand attacker behavior validate detection quality and identify opportunities for improved coverage.

• Collaborate with threat intelligence incident response purple team and platform engineering stakeholders to improve detection fidelity and reduce false positives.

• Research emerging adversary tradecraft malware behaviors command-and-control patterns infrastructure usage and campaigns relevant to the Firms threat landscape.

• Map detection opportunities and hunting activity to adversary tactics techniques and procedures including frameworks such as MITRE ATT&CK.

• Contribute to peer reviews of detection logic Python code hunt hypotheses investigation notes and automation changes to improve quality maintainability and consistency.

• Help improve the teams detection-as-code practices testing processes documentation and engineering standards.

• Continue building technical depth in detection engineering threat hunting security analytics adversary infrastructure and financial-sector cyber threats.

What youll bring to the role:

• Min 3 years of hands-on experience in cybersecurity threat intelligence threat hunting detection engineering security engineering software engineering in a security context incident response blue teaming or a related field.

• Strong Python development skills including the ability to write maintainable code work with APIs process structured and unstructured data automate workflows and troubleshoot issues independently.

• Practical experience analyzing security data logs alerts or telemetry to identify suspicious activity or understand adversary behavior.

• Familiarity with detection engineering concepts including detection logic rule tuning alert quality false-positive reduction and detection validation.

• Working knowledge of adversary tactics techniques and procedures including how attacker behavior can be converted into detection opportunities.

• Experience with tools or technologies such as ElasticSearch Sigma YARA Git SIEM platforms EDR telemetry threat intelligence platforms or similar systems.

• Ability to understand threat intelligence reporting and translate relevant behaviors indicators and infrastructure patterns into hunting or detection opportunities.

• Strong analytical thinking attention to detail and the ability to explain technical findings clearly to both technical and non-technical stakeholders.

• Ability to gather requirements from stakeholders and turn operational or investigative needs into practical maintainable technical solutions.

• Curiosity about attacker behavior security data and how to build scalable tools and detections that improve cyber defense outcomes.

Skills that would be useful but are not required:

• Experience writing or maintaining detections as code.

• Exposure to threat hunting cyber threat intelligence malware analysis adversary emulation purple-team exercises or threat-informed defense.

• Familiarity with adversary infrastructure hunting including command-and-control infrastructure domain and hosting patterns phishing infrastructure botnet infrastructure or attacker use of legitimate services.

• Exposure to cloud platforms such as AWS GCP or Azure including cloud logs security controls or common cloud attack paths.

• Relevant cybersecurity certifications.