Cybersecurity Engineer

Ensign InfoSecurity; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Ensign InfoSecurity is seeking a Cybersecurity Engineer in Singapore to oversee day-to-day operation, administration, and maintenance of cybersecurity platforms. You will ensure platform health, security, and performance while supporting continuous improvement in a complex enterprise environment.

The role requires strong SIEM experience (Splunk/QRadar/Sentinel), Linux knowledge, and scripting ability with Python or similar.

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS, or related discipline.
• Minimum 5 years in cybersecurity ops, engineering, or security platform support.
• Hands-on operator and troubleshooter of cybersecurity tech in enterprise.
• Strong SIEM experience (Splunk/QRadar/Sentinel or equivalent).
• Knowledge of log collection, data pipelines and security analytics.

Responsibilities

• Provide day-to-day ops and admin of cybersecurity platforms (SIEM, SOAR, TIP).
• Monitor health, availability, performance and capacity of platforms.
• Deploy, configure, and implement changes across production.
• Troubleshoot issues, root-cause analysis, and corrective actions.
• Onboard/maintain log sources and data pipelines.
• Prepare change requests, patches, and system upgrades.
• Collaborate with Cybersecurity Operations, DevOps, and vendors.

Skills

SIEM administration

Linux

Regex

Python scripting

Incident management

Change management

Analytical troubleshooting

Education

Bachelor's Degree in Cybersecurity/IT

Tools

Splunk

IBM QRadar

Microsoft Sentinel

SOAR

Job description

The Cybersecurity Engineer will be responsible for the day-to-day operation, administration, maintenance, deployment, and technical support of the organisation’s cybersecurity platforms and infrastructure.

The role focuses on ensuring the availability, stability, performance, and security of cybersecurity technologies supporting security monitoring and detection capabilities. The engineer will work closely with Cybersecurity Operations, DevOps, infrastructure teams, vendors, and other stakeholders to resolve technical issues, implement changes, maintain platform health, and support continuous improvement of the cybersecurity environment.

The role also involves providing technical guidance to junior engineers and participating in after-hours standby and maintenance activities where required.

Key Responsibilities

• Provide day-to-day operational support and administration of cybersecurity platforms, including SIEM, SOAR, Threat Intelligence Platform (TIP), security analytics, and related security technologies.
• Monitor the health, availability, performance, and capacity of cybersecurity platforms and proactively identify and resolve operational issues.
• Perform routine system health checks, housekeeping, maintenance, and administrative activities to ensure platform reliability and operational readiness.
• Perform the deployment, configuration, and implementation of cybersecurity platforms, components, integrations, and approved changes across the production environment in accordance with established procedures.
• Troubleshoot and resolve technical issues relating to cybersecurity platforms, including performing initial diagnostics, root-cause analysis, and corrective actions.
• Manage and maintain the lifecycle of security log sources, including onboarding, configuration, modification, monitoring, troubleshooting, and decommissioning.
• Perform operational data engineering activities, including log/data extraction, transformation, parsing, enrichment, and loading, to support security monitoring and analytics.
• Monitor the health and status of log ingestion and data pipelines and troubleshoot issues such as missing, delayed, malformed, or incomplete security data.
• Plan, test, coordinate, and implement system, application, and security patches, version upgrades, and configuration changes in accordance with established change management procedures.
• Support the implementation and maintenance of new security platform features, integrations, rules, configurations, and enhancements.
• Work closely with Cybersecurity Operations, DevOps, infrastructure teams, vendors, and technology partners to resolve operational issues and implement approved changes.
• Fulfil and manage Service Requests, Incident Requests, and Change Requests relating to cybersecurity platforms.
• Monitor service levels and ensure operational issues are tracked, progressed, and resolved within the required timelines.
• Escalate complex or unresolved technical issues to relevant Subject Matter Experts (SMEs), vendors, or support teams, and coordinate with them through to resolution.
• Review and maintain operational and technical documentation, including standard operating procedures, configuration records, technical runbooks, troubleshooting guides, and knowledge articles.
• Provide technical guidance, task assignment, and support to junior engineers where required.
• Review technical work and operational requests submitted by junior engineers to ensure compliance with established procedures and technical standards.
• Prepare and submit operational reports and provide updates on platform health, incidents, service requests, and outstanding issues.
• Participate in scheduled maintenance activities, disaster recovery/business continuity exercises, and after-hours standby support where required.
• Identify opportunities to improve operational processes, platform stability, monitoring coverage, and engineering efficiency.

Requirements

• Diploma or Bachelor's Degree in Cybersecurity, Information Technology, Computer Science, Computer Engineering, or a related discipline.
• Minimum 5 years of relevant experience in cybersecurity operations, cybersecurity engineering, security infrastructure, or enterprise security platform support.
• Hands-on experience in the operation, administration, maintenance, deployment, and troubleshooting of cybersecurity technologies in an enterprise environment.
• Strong working experience with SIEM platforms such as Splunk, IBM QRadar, Microsoft Sentinel, or equivalent.
• Experience supporting one or more of the following technologies would be advantageous:
• Security Orchestration, Automation and Response (SOAR)
• Security analytics platforms
• Log management and data ingestion platforms
• Endpoint or network security technologies
• Good understanding of security log collection, ingestion, parsing, normalization, and data pipelines.
• Good working knowledge of Linux operating systems and networking fundamentals.
• Proficiency in Regular Expressions (Regex) for log parsing, filtering, and data transformation.
• Working knowledge of scripting and automation using Python, PowerShell, Bash, or similar languages would be advantageous.
• Experience with system patching, version upgrades, configuration management, incident troubleshooting, deployment, and change management.
• Experience working with enterprise IT service management processes, including Incident, Problem, Change, and Service Request Management.
• Strong analytical and troubleshooting skills, with the ability to systematically diagnose and resolve technical issues.
• Good communication and documentation skills, with the ability to work effectively with internal teams, clients, vendors, and technical stakeholders.
• Ability to work independently, take ownership of operational issues, and manage multiple priorities in a production environment.
• Strong interest in cybersecurity and willingness to continuously develop technical knowledge.
• Willingness to participate in after-hours standby, maintenance, and support activities when required.