ICT Security Engineer (ELK Platform)

WE Asia Pte Ltd; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

WE Asia Pte Ltd seeks an ICT Security Engineer in Singapore to join the Production Security team. You will focus on the Logstash ingestion layer within the bank's SIEM platform, maintaining pipelines, troubleshooting data flow, and automating tasks with Python or Bash.

The role requires deep technical expertise in Logstash, Linux administration, and scripting, with a strong emphasis on production support and platform management.

Qualifications

• Hands-on production experience with Logstash, including troubleshooting pipelines and ingestion.
• Proficient in Linux administration (RedHat/Ubuntu), comfortable on Linux servers, checking logs, managing services, and investigating resource issues.
• Minimum 2 years of scripting/programming experience in Python or Bash for automation, log parsing and ops tasks.
• Production-grade experience with the Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) including data ingestion, indexing, monitoring and analytics.
• Strong hands-on experience with Kafka.
• Proven background in production support across both virtual and physical environments.
• Bachelor's Degree in Information Technology or a related field.
• Minimum 7 years of total professional experience, with 4–5 years focused on large-scale Elastic Stack design, deployment, and support.

Responsibilities

• Troubleshoot Logstash production pipelines, identifying and resolving ingestion failures.
• Investigate why client servers are not sending data to Logstash, and restore data flow.
• Perform health checks on Linux servers — check service status, analyze logs, and troubleshoot CPU/memory/disk issues.
• Restart and reconfigure Logstash services safely in production environments.
• Develop Python or Bash scripts for automation, log parsing, and operational tasks.
• Install, configure, and administer servers within the SIEM infrastructure.
• Manage project deliverables and contribute to platform improvements.
• Platform integration tasks including installation, configuration, documentation, and administration of pre-production and production platforms.
• Contribute to the Permanent Control framework and ensure compliance with regulatory requirements and incident reporting processes.

Skills

Logstash

Linux administration

Python/Bash scripting

Elastic Stack

Kafka

Production support

7+ years total experience

ELK design/deploy

Education

Bachelor's Degree in Information Technology or related field

Tools

Elasticsearch

Kibana

Beats

Job description

We are seeking a skilled ICT Security Engineer to join the Production Security team of a leading financial institution in Singapore. This role is focused on strengthening the bank's ability to detect and respond to cyber threats through the deployment, maintenance, and continuous improvement of its SIEM infrastructure.

While the broader team manages security infrastructure, this specific role is primarily focused on the operational stability and troubleshooting of the Logstash ingestion layer within the bank's SIEM platform.

The day-to-day work involves maintaining Logstash servers, troubleshooting pipeline failures, investigating ingestion issues on Linux servers, and writing Python/Bash scripts for automation. You will work closely with Production Infrastructure and Observability teams to ensure logs from thousands of servers flow seamlessly into the ELK platform.

The successful candidate will be a full-time member of the Production CSIRT / SIEM Engineering team, with opportunities to expand the scope of activities within the team.

This role requires deep technical expertise in Logstash, Linux administration, and scripting (Python or Bash) , with a strong focus on production support and platform management. The ideal candidate is rigorous, self-driven, and comfortable working autonomously in a fast-paced environment.

Core Responsibilities (Day-to-Day)

• Troubleshoot Logstash production pipelines, including identifying and resolving ingestion failures.
• Investigate why client servers are not sending data to Logstash, and restore data flow.
• Perform health checks on Linux servers — checking service status (systemctl), analyzing logs, and investigating CPU/memory/disk issues.
• Restart and reconfigure Logstash services safely in production environments.
• Develop Python or Bash scripts for automation, log parsing, and operational tasks.

Platform Management

• Install, configure, and administer servers within the SIEM infrastructure.
• Manage project deliverables and contribute to platform improvements.
• Platform integration skills, including installation, configuration, documentation, and administration of pre-production and production platforms.

Compliance & Governance

• Contribute to the Permanent Control framework by implementing policies and procedures in day-to-day business activities, such as the Control Plan.
• Comply with regulatory requirements and internal guidelines.
• Contribute to the reporting of all incidents according to the Incident Management System.

Mandatory (Must-Have)

• Hands-on production experience with Logstash — including troubleshooting pipelines, ingestion failures, and service management.
• Proficient in Linux administration (RedHat / Ubuntu) — comfortable working directly on Linux servers, checking logs, managing services, and investigating resource issues.
• Minimum 2 years of scripting/programming experience in Python or Bash — used for automation, log parsing, and operational scripting.
• Production-grade experience with the broader Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) , including data ingestion, indexing, monitoring, and analytics.
• Strong hands-on experience with Kafka.
• Proven background in production support across both virtual and physical environments.
• Bachelor's Degree in Information Technology or a related field.
• Minimum 7 years of total professional experience, with at least 4–5 years focused on large-scale Elastic Stack (ELK) design, deployment, and support.

Preferred (Nice-to-Have)

• Experience with automation/orchestration tools (e.g., Ansible or equivalent) and CI/CD pipelines.
• Platform integration skills, including installation, configuration, documentation, and administration of pre-production and production platforms.
• Banking sector experience is optional but regarded as a plus.

Personal Attributes

• Rigorous and detail-oriented approach to work.
• Strong analytical and problem-solving skills.
• Self-driven — able to work autonomously and take ownership of tasks.
• Excellent communication skills and a collaborative team player.
• High energy, proactive attitude, and a willingness to upskill.
• Ability to manage multiple priorities simultaneously.