Cybersecurity Engineer (Security Operations, CIOO)

Assurity Trusted Solutions; Singapore; On-site; SGD 90,000 - 150,000; Full time

Job summary

Assurity Trusted Solutions (ATS) is a GovTech subsidiary delivering trusted digital security services. The team monitors and investigates security alerts across cloud, SaaS, and infrastructure, triaging findings and coordinating remediation with product and platform teams.

Experience with Wiz, Tenable, Datadog SIEM, Elastic and cloud-native security platforms is required, along with strong log analysis and detection rule engineering skills. AWS, Azure, Google Cloud familiarity is a plus.

Qualifications

• Experience with cloud security platforms and vulnerability management.
• Hands-on security operations and incident-response experience.
• Familiarity with SIEM tools and cloud-native security services.

Responsibilities

• Monitor and investigate security alerts across cloud, SaaS, app, and infra environments.
• Triage findings, determine relevance, and coordinate remediation with product teams.
• Maintain and tune Datadog SIEM, alerts, dashboards, and detection rules.
• Develop detection logic and runbooks for incident response.

Skills

Wiz

Tenable

Datadog SIEM

Elastic

Microsoft Sentinel

Chronicle

Splunk

Defender

GuardDuty

Security analytics

KQL

SQL

Python

Tools

KQL

SQL

Python

Job description

Assurity Trusted Solutions (ATS) is a wholly owned subsidiary of the Government Technology Agency (GovTech). As a Trusted Partner over the last decade. ATS offers a comprehensive suite of products and services ranging from infrastructure and operational services, governance and assurance services as well as managed processes. In a dynamic digital & cyber landscape where trust & collaboration is key, ATS continues to drive mutually beneficial business outcomes through collaboration with GovTech, government agencies and commercial partners to mitigate cyber risks and bolster security postures.

Responsibilities: Monitor and investigate security alerts, suspicious activity, vulnerabilities and incidents across cloud, SaaS, application and infrastructure environments. Triage security findings, determine their relevance and severity, identify affected systems and coordinate practical remediation with product and platform teams. Drive findings through the full lifecycle from detection to mitigation, evidence collection, risk acceptance where appropriate and formal closure. Maintain clear ownership, due dates and escalation paths. Operate and improve attack-surface management, including asset discovery, domain and service exposure, stale or unmanaged assets, ownership tracking and remediation follow-up. Manage vulnerability information from security scanners, cloud-security platforms and security alerts. Correlate duplicate findings and focus attention on exploitable attack paths and material risk. Support the onboarding and validation of production security logs to central monitoring, including log-source selection, ingestion checks, parsing, coverage evidence and troubleshooting with product teams. Operate and improve automated baseline and privileged-activity log review for required monitoring use cases. Tune rules and distinguish meaningful deviations from expected administrative or deployment activity. Maintain the Datadog security information and event management (SIEM) platform, including log-source health, parsing, dashboards, alerting and coverage. Write and tune customised detection rules for GovTech-specific security use cases. Develop and maintain detection logic, queries, dashboards and alert workflows for cloud and SaaS platforms. Reduce noise while preserving visibility of high-value security signals. Support incident response by establishing timelines, collecting relevant evidence, coordinating containment and recovery actions, documenting decisions and confirming that follow-up actions address the underlying cause. Build and maintain workflow automation for common incidents and recurring operational tasks, including alert enrichment, team notification, ticket creation, evidence gathering and status reporting.

Support insider-risk monitoring and related security investigations with appropriate confidentiality, evidence handling, escalation and coordination with relevant stakeholders. Maintain operational runbooks, detection documentation, log-source inventories, incident records, lessons learned and metrics for response performance and recurring gaps.

Experience with AWS, Microsoft Azure, Google Cloud, Microsoft 365, Google Workspace or other cloud and SaaS platforms. Experience with Wiz, Tenable, Datadog SIEM, Elastic, Microsoft Sentinel, Chronicle, Splunk, Defender, GuardDuty or comparable cloud-security, vulnerability-management, monitoring and security platforms. Experience with incident-response case management, ticketing, security orchestration and automated response workflows. Experience analysing security logs, onboarding log sources, validating coverage, normalising events, tuning detections or maintaining detection-as-code practices. Experience with vulnerability scanners, cloud-security platforms, vulnerability-management workflows and attack-surface management. Relevant certifications such as Security+, CySA+, GCIH, GCDA, SC-200 or equivalent practical experience. Certifications are useful but do not replace investigation ability.

Experience Hands-on experience in security operations, incident response, detection engineering, cloud security, vulnerability management, attack-surface management or a closely related technical security area. Practical experience with Wiz and Tenable is required, or with directly comparable cloud-security and vulnerability-management platforms. Strong log-analysis skills and understanding of alerts, indicators of compromise, authentication activity, network or application behaviour and the evidence needed to investigate a security event. Experience maintaining a security information and event management (SIEM) platform, preferably Datadog SIEM, including log-source onboarding, parsing, dashboards, alerting and customised detection rules. Ability to write and troubleshoot queries, detection rules or scripts using at least one relevant language or query language, such as Kusto Query Language (KQL), SQL, Python or a comparable tool. Good understanding of cloud a