Client Security Lead (CSL)

About THEOS

Our mission is to empower businesses to thrive in the new digital security age by helping define and execute strategies to achieve cyber resilience.  Delivering security outcomes, not silver bullets.  We are a team of experts in two primary security practices, Defense and Offense where the Defense Practice includes Security Architecture, Threat & Vulnerability Management and Managed Detection & Response (MDR). 

We deliver Premium Security Services to local and international clients, SMEs, and Enterprises, by leveraging leading technologies and expertise that are traditionally only accessible to high end global customers, some of which are also our clients.

We value true Passion for Security, Innovation in our approach to Solutions and Services, and Continuous Development of People.  Importantly, we deliver on our commitments.

The Role

Most clients do not want more alerts. They want to know that someone who understands their environment is looking after it, and they want a straight answer when they ask a question. That is this job.

The Client Security Lead (CSL) is the named technical security owner for a defined set of client accounts and is accountable for the effectiveness and continuous improvement of the MTDR service delivered to those clients.

The CSL is the two-way technical interface between the client and Theos Defence. They represent the client within the SOC, ensuring analysts understand the client's environment, technology, business context and security priorities. At the same time, they represent the MTDR service to the client, explaining what is being detected, why it matters, what has been investigated, and what should happen next.

The CSL personally is responsible for detection quality and engineering, threat hunting and technical investigation for their assigned accounts, while providing technical leadership and quality oversight to the analysts supporting them.

What you will do

Be the client’s security champion. Maintain deep context of their architecture, asset inventory, and strategic roadmap so you can anticipate monitoring gaps before they become blind spots. Lead monthly reviews to walk through events of interest and security posture enhancements.

Bridge the gap between the client and the SOC. You’re the insider advocate for your accounts. Bring client context to our analysts and engineers so no one is ever triage-ing alerts blindly. Handle escalations when an analyst gets stuck or needs deep client context.

Run real, hypothesis-driven threat hunts. Skip the lazy port scans. You’ll form hypotheses based on sector-relevant CTI, known detection gaps, and actual attack paths (ATT&CK mapped). Find the stuff our automated rules missed.

Convert Threat Intel into detections. Intel without action is just news. Monitor the evolving threat landscape for your clients' technologies, translating relevant indicators and TTPs into actionable detection logic.

Kill the noise (Own Detection Quality). High-noise, zero-signal alerts are a crime. Continuously audit, tune, and prune detection rules for your accounts. Every noisy alert gets reviewed and either fixed or killed.

Spot the non-detection flaws. If you find a misconfiguration, a glaring AD risk, or a broken baseline control while hunting, don't keep quiet. Bring concrete, sensible fixes to the client and help them remediate it.

Get hands-on during real incidents. When a major incident hits your account, you’ll be diving deep into the logs. Correlate telemetry across endpoint, identity, cloud, and network logs to construct a clear timeline, blast radius, and root cause analysis.

Support cyber response operations. Contribute environment context, custom hunting queries, and detection logic to active compromise assessments and incident response engagements.

Level up the analysts. Do quality checks on investigations, mentor junior analysts, and treat their daily pain points as fuel for detection engineering improvements..

What We’re Looking For

1.      Detection Engineering

·       You’ve built, tuned, and retired detection rules in major SIEM/XDR platforms. Direct experience with Microsoft Sentinel or CrowdStrike Falcon is a huge plus, but strong query fluency on another platform works too.

·       You can write non-trivial detection logic independently.

·       You get that tightening a rule to cut down alert fatigue inherently risks missing edge cases, and you can comfortably weigh that trade-off.

2.      Incident Analysis & Threat Hunting

·       Experience in threat hunting or incident response. You’ve owned hunts and incidents from initial signal to root cause, not just closed out surface-level alerts.

·       You can structure a hunt around a testable hypothesis and, crucial for a real hunter, you know what evidence would prove your theory wrong.

·       You can piece together logs across endpoint, identity, cloud, and network to reconstruct a clear timeline and map the blast radius.

3.      Cloud & Identity Security

·       Working knowledge of at least one major cloud/identity ecosystem (Microsoft Azure, Entra ID, M335, or AWS).

·       You can trace activity through cloud audit and sign-in logs, whether it’s token theft, privilege escalation, malicious mailbox rules, or anomalous resource access and map it back to endpoint activity.

·       You understand how real-world cloud/identity attacks operate in practice (e.g., password spraying, consent phishing, excessive permission abuse).

4.      Client & Stakeholder Capability

·       Comfortable sitting across from senior leadership and technical teams alike. You can drill down into technical nuances or zoom out to explain business impact and risk to non-technical decision-makers.

·       You write crisp, professional documentation that can go straight to a client without needing an editor to rewrite it.

·       You map out unfamiliar technical environments quickly and keep your mental model updated as things change.

5.      Nice to Have (Not Required)

·       Multi-Account MSSP/Consulting Background: Experience juggling multiple client accounts simultaneously.

·       Formal IR or compromise assessment background, including forensic timeline reconstruction and evidence handling.

·       Python or PowerShell skills to quickly prototype tools or automate repeatable workflows.

·       Practical understanding of AI/AI Agent security risks and novel attack vectors.

·       Familiarity with threat actors, TTPs, and sector risks specific to the Asia-Pacific region.