Detection Engineer, Associate/Director (Assistant VP)

Threat Hunt and Cyber Detection (THCD) is looking for a detection engineer with a threat hunting mindset to join our global team in Singapore. The THCD mission is to seek out attacks against the Morgan Stanley network, engineer high-quality detection strategies, and reduce risk to Morgan Stanley assets. As a Threat Hunt team member, you will focus on developing and maintaining detections, analyzing adversary behavior, improving security telemetry, and enhancing bespoke tools used to defend the Morgan Stanley network. 

In the Technology division, we leverage innovation to build the connections and capabilities that power our Firm, enabling our clients and colleagues to redefine markets and shape the future of our communities. 

Since 1935, Morgan Stanley has been known as a global leader in financial services, always evolving and innovating to better serve our clients and our communities in more than 40 countries around the world. 

At Morgan Stanley Singapore, we serve as the Firm’s Southeast Asia headquarters and regional hub, supporting Morgan Stanley’s businesses across the region. Morgan Stanley has had a presence in Singapore since 1990, and our Singapore office provides capabilities across investment banking, equity and fixed income research, securities trading, derivatives, commodities, private wealth management, and investment management. Located at IOI Central Boulevard Towers in downtown Singapore, our Southeast Asia headquarters provides a world-class work environment, advanced technology infrastructure, and collaborative facilities that help our teams deliver best-in-class services and solutions for clients. Everyone is encouraged to chart their own meaningful career and achieve goals with the support of our training, development, and global collaboration opportunities. 

What you’ll do in the role: 

• Develop, test, tune, and maintain detection logic to identify suspicious activity across endpoint, network, identity, application, and other enterprise telemetry sources. 

• Translate adversary behaviors, threat intelligence, and hunt hypotheses into practical detection strategies and measurable detection coverage. 

• Use Python to build automation, parse and enrich security data, support detection engineering workflows, and improve bespoke threat hunting and detection tools. 

• Work with technologies such as Sigma, YARA, ElasticSearch, Git, Python, and related security analytics platforms to create and maintain detection content. 

• Investigate security signals and suspicious activity to understand attacker behavior, validate detection quality, and identify opportunities for improved coverage. 

• Collaborate with threat intelligence, incident response, purple team, and platform engineering stakeholders to improve detection fidelity and reduce false positives. 

• Research emerging adversary tradecraft, malware behaviors, command-and-control patterns, infrastructure usage, and campaigns relevant to the Firm’s threat landscape. 

• Map detection opportunities and hunting activity to adversary tactics, techniques, and procedures, including frameworks such as MITRE ATT&CK. 

• Contribute to peer reviews of detection logic, Python code, hunt hypotheses, investigation notes, and automation changes to improve quality, maintainability, and consistency. 

• Help improve the team’s detection-as-code practices, testing processes, documentation, and engineering standards. 

• Continue building technical depth in detection engineering, threat hunting, security analytics, adversary infrastructure, and financial-sector cyber threats. 

What you’ll bring to the role: 

• Min 3 years of hands-on experience in cybersecurity, threat intelligence, threat hunting, detection engineering, security engineering, software engineering in a security context, incident response, blue teaming, or a related field. 

• Strong Python development skills, including the ability to write maintainable code, work with APIs, process structured and unstructured data, automate workflows, and troubleshoot issues independently. 

• Practical experience analyzing security data, logs, alerts, or telemetry to identify suspicious activity or understand adversary behavior. 

• Familiarity with detection engineering concepts, including detection logic, rule tuning, alert quality, false-positive reduction, and detection validation. 

• Working knowledge of adversary tactics, techniques, and procedures, including how attacker behavior can be converted into detection opportunities. 

• Experience with tools or technologies such as ElasticSearch, Sigma, YARA, Git, SIEM platforms, EDR telemetry, threat intelligence platforms, or similar systems. 

• Ability to understand threat intelligence reporting and translate relevant behaviors, indicators, and infrastructure patterns into hunting or detection opportunities. 

• Strong analytical thinking, attention to detail, and the ability to explain technical findings clearly to both technical and non-technical stakeholders. 

• Ability to gather requirements from stakeholders and turn operational or investigative needs into practical, maintainable technical solutions. 

• Curiosity about attacker behavior, security data, and how to build scalable tools and detections that improve cyber defense outcomes. 

Skills that would be useful but are not required: 

• Experience writing or maintaining detections as code. 

• Exposure to threat hunting, cyber threat intelligence, malware analysis, adversary emulation, purple-team exercises, or threat-informed defense. 

• Familiarity with adversary infrastructure hunting, including command-and-control infrastructure, domain and hosting patterns, phishing infrastructure, botnet infrastructure, or attacker use of legitimate services. 

• Exposure to cloud platforms such as AWS, GCP, or Azure, including cloud logs, security controls, or common cloud attack paths. 

• Relevant cybersecurity certifications.