ISIMI - Digital Forensic Investigation / eDiscovery Collection Case - Associate/VP

About Us
Morgan Stanley is a leading global financial services firm providing a wide range of investment banking, securities, investment management and wealth management services. We advise, originate, trade, manage and distribute capital for governments, institutions and individuals. As a market leader, the talent and passion of our people is critical to our success. Together, we share a common set of values rooted in integrity, excellence and strong team ethic. We provide you a superior foundation for building a professional career where you can learn, achieve and grow.

Technology/Role/Department at Morgan Stanley
The mission of Cyber Data Risk & Resilience (CDRR) is to deliver first-line defenses to manage risks to Firm technology, information and cyber threats through risk identification, control management and assurance. This allows the business to operate and grow in a secure and legally compliant manner.
Our vision is to deliver Programs that protect and enable the business, ensure secure delivery of services to our clients, adjust to address the risks presented by an evolving threat landscape, meet regulatory expectations, and offer highly attractive career opportunities.

Position Description
Morgan Stanley is seeking an ambitious candidate to join their Global eDiscovery and Investigations (GEDI) group within the InfoSec Incident Management and Investigations (ISIMI) organization as a Senior Digital Forensics Investigation and eDiscovery specialist. The group is responsible for insider threat investigations, and managing requests for electronic data and digital forensic investigations that relate to Litigation, Regulatory matters, Compliance, Employee Investigations as well as Incident Response and Cyber Security events. This is a challenging position with responsibility to lead complex eDiscovery and investigation cases. This is an excellent opportunity to join a dynamic global function in the Singapore office.

A Senior Digital Forensics Investigation case lead will conduct digital investigations, which includes collecting and analyzing data from electronic sources such as infrastructure logs, hosted application logs, Windows and Linux OS, network file servers, and eCommunications archives. Communicating complex technical matters and extensive interaction is required with colleagues both internal and external to Technology including Legal and Compliance, Corporate Security, Human Resources, Cyber Security, Engineering teams, and other Business groups. The candidate must demonstrate and practice highest risk management mindset in their day-to-day operation, including making sound judgement calls and providing guidance to clients. The candidate will be well-organized, have strong communication and analytical skills, be able to turnaround time sensitive matters without compromising quality, be able to manage client expectations, be confident working independently and comfortable with the handling of confidential information to support management decisions.

As an eDiscovery case lead, this role will also perform electronic data discovery/collection that includes, but not limited to, collecting and analyzing data from electronic data sources such as email archives, infrastructure logs and network file from local servers and cloud. The data will be provided to clients both internal and external to the Firm. Experience of handling regulatory requests and understanding of international data collection considerations will be beneficial.

An ideal candidate will be well-organized, analytical, have strong communication and time management skills, able to demonstrate a detail oriented approach to quickly solve complex problems for the organization. Additionally, you will be responsible for mentoring and developing team members and fostering a collaborative work environment. Proven track record of effective leadership will be desirable.

Skills Required:

- Experience with digital investigations, incident response, insider threat or data exfiltration incidents
- Strong technical acumen, with ability to drive results with a collaborative approach, solve problems front-to-back and autonomously makes effective decisions
- Strong SIEM data analysis and correlation skills with comfort to work through complex data sets, by analyzing and formulating queries with a nimble approach (e.g., Splunk)
- Experience of infrastructure logs analysis and correlation (e.g. proxy, authentication, networking and security events)
- Experience in end point and network forensic data recovery and analysis, including working knowledge of forensic tools (e.g., Axiom, Microsoft Defender, Nuix, EnCase)
- Proven experience in a client facing role with excellent customer service skills, and ability to work under pressure while handling complex requests
- Working knowledge of data retrieval from message archive systems or data repositories, including formulation and troubleshooting of complex data collection criteria
- Strong working knowledge of Microsoft M365
- Strong ability to articulate complex issues concisely, collaborative, organized and attentive to detail
- High level of work ethic - demonstrated by following policies and procedures, making good judgement and escalating issues promptly
- Organized, attentive to detail, with planning and deductive reasoning skillset
- Very strong verbal and written communication skills with strong ability to articulate complex issues concisely
- Excellent interpersonal skills, flexible and self-motivator

Skills Desired:

- Experience working with regulatory, compliance and/or litigation group within the Financial Industry
- Experience coaching and developing team members
- Scripting capability (e.g. with Python, PowerShell) for data processing and automation
- Experience in investigation report writing and presentation
- Solid work experience of min. 3 years in a financial services sector
- Exposure to technology risk and security, and infrastructure knowledge within the Financial Industry
- Experience working internationally with peers/clients in different regions and time zones
- Technical or Information Security Certifications (e.g. GCFE, GCFA, GNFA, CISSP) is an advantage but not a must