Platform Engineer, Director (Assistant VP)

Threat Hunt and Cyber Detection (THCD) is looking for a detection engineer with a threat hunting mindset to join our global team in Singapore. The THCD mission is to seek out attacks against the Morgan Stanley network, engineer high-quality detection strategies, and reduce risk to Morgan Stanley assets. As a Threat Hunt team member, you will focus on developing and maintaining detections, analyzing adversary behavior, improving security telemetry, and enhancing bespoke tools used to defend the Morgan Stanley network. In the Technology division, we leverage innovation to build the connections and capabilities that power our Firm, enabling our clients and colleagues to redefine markets and shape the future of our communities. Since 1935, Morgan Stanley has been known as a global leader in financial services, always evolving and innovating to better serve our clients and our communities in more than 40 countries around the world. At Morgan Stanley Singapore, we serve as the Firm’s Southeast Asia headquarters and regional hub, supporting Morgan Stanley’s businesses across the region. Morgan Stanley has had a presence in Singapore since 1990, and our Singapore office provides capabilities across investment banking, equity and fixed income research, securities trading, derivatives, commodities, private wealth management, and investment management. Located at IOI Central Boulevard Towers in downtown Singapore, our Southeast Asia headquarters provides a world-class work environment, advanced technology infrastructure, and collaborative facilities that help our teams deliver best-in-class services and solutions for clients. Everyone is encouraged to chart their own meaningful career and achieve goals with the support of our training, development, and global collaboration opportunities. What you’ll do in the role: * Develop, test, tune, and maintain detection logic to identify suspicious activity across endpoint, network, identity, application, and other enterprise telemetry sources. * Translate adversary behaviors, threat intelligence, and hunt hypotheses into practical detection strategies and measurable detection coverage. * Use Python to build automation, parse and enrich security data, support detection engineering workflows, and improve bespoke threat hunting and detection tools. * Work with technologies such as Sigma, YARA, ElasticSearch, Git, Python, and related security analytics platforms to create and maintain detection content. * Investigate security signals and suspicious activity to understand attacker behavior, validate detection quality, and identify opportunities for improved coverage. * Collaborate with threat intelligence, incident response, purple team, and platform engineering stakeholders to improve detection fidelity and reduce false positives. * Research emerging adversary tradecraft, malware behaviors, command-and-control patterns, infrastructure usage, and campaigns relevant to the Firm’s threat landscape. * Map detection opportunities and hunting activity to adversary tactics, techniques, and procedures, including frameworks such as MITRE ATT&CK. * Contribute to peer reviews of detection logic, Python code, hunt hypotheses, investigation notes, and automation changes to improve quality, maintainability, and consistency. * Help improve the team’s detection-as-code practices, testing processes, documentation, and engineering standards. * Continue building technical depth in detection engineering, threat hunting, security analytics, adversary infrastructure, and financial-sector cyber threats. * What you’ll bring to the role: * Min 3 years of hands-on experience in cybersecurity, threat intelligence, threat hunting, detection engineering, security engineering, software engineering in a security context, incident response, blue teaming, or a related field. * Strong Python development skills, including the ability to write maintainable code, work with APIs, process structured and...