Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowFirst seen 5 days ago

Senior Director - Cyber & Digital Forensic Investigations - Singapore

Search & Counsel132 open roles

Where
Singapore
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Director - Cyber & Digital Forensic Investigations - SingaporeSearch & Counsel · Singapore

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Search & Counsel's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 58.1%60 days
This job: first seen 5 days ago

The posting

We are seeking a senior Cyber and Digital Forensic Investigations practitioner to join our client in Singapore at Senior Director level. The ideal candidate will hold senior incident-response and digital-forensics credentials with at least 10 years of relevant experience, the most recent 3+ years at Director or equivalent senior-leadership level, and a track record of incident-command on bet-the-company breaches admissible in regulator and litigation review. The successful candidate will lead the most complex multi-jurisdictional cyber investigations, define the practice's incident-command doctrine and signed-off declaration practice, carry a meaningful named-account pipeline across the regional breach-coach and cyber-litigation bar, and contribute to the practice's strategy as an emerging Partner-track operator.

Confidential Client. Applying to this position means that you are interested to have an initial confidential discussion about how we can help you to identify and join a new cyber and digital forensic investigations practice. With your authorisation we will exclusively run the entire application and recruitment process for you, keeping you apprised at every step. With over 30 years' combined experience of helping the most talented cyber-investigations practitioners to make safe exits to launch rewarding new careers, we have the experience, network and ability to help you.

Key Responsibilities:

  • Lead high-stakes breach-response engagements, typically running USD 750k - 4m, with full responsibility for incident-command, technical strategy, evidentiary discipline and stakeholder communication on bet-the-company cyber matters.
  • Define the practice's incident-command doctrine on ransomware, BEC, advanced-persistent-threat, insider-threat, supply-chain, cloud-account-takeover and nation-state intrusion fact patterns; set the bar for what is - and is not - defensible against regulator and class-action review.
  • Lead the most complex host, network, cloud and memory forensics on enterprise-scale investigations, including identity-provider compromise (Entra ID, Okta), Kubernetes / container-runtime intrusion, OT-and-IT convergence incidents, AI-system compromise and prompt-injection investigations, and ephemeral-messaging-platform-mediated insider threat.
  • Take signed-off positions on threat-actor attribution, root-cause findings and lessons-learned reports at instructing-counsel and regulator level; engage on disclosure-and-notification timing under MAS cyber-incident-notification obligations, the Cybersecurity Act 2018 / 2024 (Amendment), IMDA Critical Information Infrastructure Code and PDPA obligations.
  • Direct ransomware-response engagements on the most complex matters, including multi-stage extortion, exfiltration-only and double-extortion patterns, with sanctions-screening governance under OFAC, Singapore TSOFA and MAS Targeted Financial Sanctions advisory.
  • Develop and own a sustained pipeline of named accounts at General Counsel, CISO, Chief Risk Officer and Chief Compliance Officer level, and at relevant law firm partner level; originate or co-originate USD 1.5m+ annually in qualified cyber-investigations opportunities.
  • Convert reactive case work into multi-year retainer engagements covering incident-response retainer, managed-detection-and-response (MDR), threat-hunting, tabletop-exercise programmes and CISO-advisory work.
  • Set methodology and tooling-strategy direction within the cyber-investigations sub-practice; define the framework on AI-assisted DFIR governance; directly supervise, mentor and advocate for Directors and Senior Managers - championing their advancement at promotion rounds, sponsoring sustained upskilling on emerging methodology and AI tooling, and shaping their external profile-building on incident-command depth.

Required Qualifications and Skills:

  • Multiple senior incident-response and / or digital-forensics credentials, such as GCFA (GIAC Certified Forensic Analyst) plus GREM (GIAC Reverse-Engineering Malware) plus CISSP (Certified Information Systems Security Professional), or GNFA plus GCIH plus CISM - typically multiple at this level.
  • At least 10 years of relevant experience in cyber investigations, incident response or digital forensics, with the most recent 3+ years at Director or equivalent senior-leadership level.
  • Demonstrable track record of leading bet-the-company cyber-investigations matters with full incident-command and client-facing responsibility, including signed-off threat-actor-attribution and root-cause findings under regulator and litigation review.
  • Direct experience operating with General Counsel, CISOs, Chief Risk Officers and Chief Compliance Officers, breach coaches at law-firm partner level and Singapore regulators (CSA, IMDA, MAS, PDPC).
  • Working knowledge at supervisory-policy depth of the Singapore cyber-incident framework: the Cybersecurity Act 2018 and 2024 (Amendment) Act, IMDA Cybersecurity Code of Practice for Critical Information Infrastructure, MAS Technology Risk Management Guidelines and MAS cyber-incident-notification obligations, PDPA data-breach notification framework and Personal Data Protection Commission enforcement-decision pattern at post-2024 depth.
  • Authority on NIST 800-61, NIST 800-86, the MITRE ATT&CK framework, MITRE D3FEND, the SANS DFIR methodology, the Cyber Kill Chain and the FOR578 / FOR508 incident-response curriculum.
  • Familiarity with industry-standard DFIR tooling, including SIEM platforms (such as Splunk, Microsoft Sentinel, QRadar or Elastic), EDR (such as CrowdStrike Falcon, SentinelOne, Carbon Black or Microsoft Defender), forensic-imaging and analysis tools (such as EnCase, Magnet Axiom, X-Ways or FTK), memory-analysis tools (such as Volatility or Rekall), network-forensics tools (such as Wireshark, Zeek or Arkime), and reverse-engineering tools (such as IDA Pro, Ghidra or x64dbg).
  • Demonstrable history of converting cyber-investigations engagement relationships into multi-year incident-response retainer, managed-detection-and-response or CISO-advisory work.
  • Established relationships with law firm partners in cyber and data-breach practice, regulatory enforcement, white-collar crime, internal-investigations and class-action / privacy-litigation practices who refer and instruct cyber-investigations work; sustained named-account level engagement is the strongest evidence.
  • High-agency operating style, calm and credible under live-incident and adversarial-challenge pressure, with the methodological discipline to ensure findings are evidence-based, structured and defensible.

Preferred Experience:

  • Stacking credentials including offensive-security qualifications (such as OSCP, CRTO or CRTP) and reverse-engineering depth (GREM).
  • Postgraduate qualification: Master's in computer science, information security, digital forensics, MBA, or LLM with cyber-law / privacy / regulatory relevance.
  • Multilingual capability (Mandarin, Bahasa, Hokkien) for regional witness, custodian and threat-actor-communication contexts.
  • Cross-border breach-response experience across Southeast Asia, Greater China, India and South Asia.
  • Published authorship on incident-response, threat-hunting, ransomware-response or attribution themes; conference-level speaking on cyber investigations.
  • Track record of testifying or signed-off declaration on cyber-investigations issues in arbitration, court or regulator proceedings.
  • Tabletop-exercise design and CISO-advisory programme delivery at audit-committee level.
  • Growth-mindset operating posture and visible engagement with the AI developments reshaping cyber and digital forensic investigations: candidates who track tooling shifts (such as AI-assisted DFIR via CrowdStrike Charlotte AI or Microsoft Sentinel Copilot, prompt-injection defence, AI-system-compromise investigations, or LLM-aided malware-analysis triage), share that knowledge with the Director and Manager bench under their supervision, and have a track record of building team-upskilling programmes on emerging methodologies.

Compensation:

Competitive package commensurate with seniority and experience, including base, performance-based bonus, long-term incentives and (where applicable) partner-track equity participation.

Next Steps:

This opportunity is open to Singaporeans, Singapore permanent residents, and qualified candidates with relevant work-rights status who match the above criteria. Please apply to receive prompt contact from an experienced and specialist cyber and digital forensic investigations recruitment consultant.

Search & Counsel is a trading style of Feltan Associates Pte Ltd; an international Executive Search, Recruitment and Consulting business based in Singapore, licensed and regulated by the Singapore Ministry of Manpower to conduct recruitment services for clients. UEN: 202225620G. EA Licence 23S1672. All rights reserved.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Search & Counsel's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Search & Counsel's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Search & Counsel's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.