Information Technology Security Engineer

Ascendion; Singapore; On-site; SGD 90,000 - 150,000; Full time

Job summary

Ascendion is seeking an IT Security Engineer to implement, operate, and support security controls for mission-critical systems within a secured environment in Singapore. The role spans Day 1 project security and Day 2 production security, collaborating with Security Leads, Infra, System, and Software teams to ensure adherence to IM8, WOG, and PDPA requirements.

You will drive security in CI/CD, perform risk assessments, coordinate VA/PT activities, manage access controls (RBAC, MFA, PAM), and

Qualifications

• Degree in Computer Science / Cybersecurity / Information Security or equivalent.
• 3–7 years of IT experience in cybersecurity or infrastructure security.
• Experience supporting security in projects or production environments.
• Familiarity with Singapore Government security policies (IM8 preferred).
• Hands-on experience with IAM and access control, SIEM, vulnerability scanners, CI/CD, and DevSecOps.

Responsibilities

• Security Implementation & Engineering across platforms.
• Compliance with IM8, Government security policies, WOG, and PDPA.
• DevSecOps: SAST, DAST, SCA, container scanning and remediation.
• Security Testing Support: VA/PT and go-live readiness.
• Vulnerability tracking, patching, and audit evidence.
• Access control administration: RBAC, MFA, PAM; least privilege reviews.
• Incident response support and log analysis.
• Configuration of API Gateways, WAF, and cloud security basics.

Skills

Security controls

Threat modelling

DevSecOps

RBAC

MFA

PAM

Log analysis

Education

Degree in Computer Science / Cybersecurity / Information Security or equivalent

Tools

SIEM

Vulnerability scanners

CI/CD tooling

IAM platform

Job description

The IT Security Engineer will be responsible for implementing, operating, and supporting security controls for mission-critical systems within a secured environment.

This role covers both:

• Day 1 Security (Build / Project Implementation)
• Day 2 Security (Operations / Production Support)
• The Security Engineer will work closely with Security Leads, Infra, System, and Software teams to ensure compliance with government security policies and standards.

Responsibilities:

Day 1 – Project / Implementation Security

1. Security Implementation & Engineering

• Implement security architecture and controls as designed by Security Leads/Architects
• Support system, application, and infrastructure security configurations
• Assist in threat modelling and risk assessment activities
• Translate security requirements into technical implementation across platforms

2. Compliance Support

• Support compliance with:
• IM8 / Government security policies
• Whole of Government (WOG) security requirements
• PDPA (where applicable)
• Assist in preparation and documentation for:
• Security Risk Assessments (SRA)
• Vulnerability Assessments (VA)
• Penetration Testing (PT)
• Maintain security documentation and evidence for audits

3. DevSecOps & Secure Development

• Implement and maintain security tools in CI/CD pipelines:
• SAST, DAST, SCA, container scanning
• Monitor and triage findings, and work with developers on remediation
• Support secure coding practices and DevSecOps adoption
• Assist in API security, secrets management, and secure communications setup

4. Security Testing Support

• Support coordination and execution of VA/PT activities
• Track vulnerabilities and ensure timely remediation
• Assist in documenting findings and closure evidence
• Support system security certification and go-live requirements
• Implement and maintain security hardening for:
• Operating systems
• Middleware and databases
• Kubernetes and containers (RBAC, secrets, network policies)
• Support configuration of:
• API Gateways
• WAF
• Authentication and authorization mechanisms (OAuth2, mTLS)

Day 2 – Operations / Production Security

• Support investigation, containment, and remediation of security incidents
• Perform log analysis and assist in root cause analysis (RCA)
• Work with SOC and internal teams during incidents
• Follow and improve incident response playbooks

2. Vulnerability & Patch Management

• Perform regular vulnerability scans and monitoring
• Track and verify patching and remediation activities
• Escalate high-risk vulnerabilities and propose mitigation controls

3. Security Monitoring

• Monitor alerts from SIEM and security tools
• Assist in tuning detection rules and dashboards
• Ensure logging and monitoring coverage across systems

4. Audit & Compliance Support

• Support audit preparation, evidence collection, and remediation tracking
• Maintain security records and documentation
• Assist in reporting security posture and issues

5. Access Control Administration

• Support implementation of:
• RBAC
• MFA
• Privileged Access Management (PAM)
• Perform user access reviews and ensure least privilege

Required Skills:

• Degree in Computer Science / Cybersecurity / Information Security or equivalent
• 3–7 years of IT experience in cybersecurity or infrastructure security
• Experience supporting security in projects or production environments
• Familiarity with Singapore Government security policies (IM8 preferred)
• Hands-on experience with:
• IAM and access control
• Security tools (SAST, DAST, SIEM, vulnerability scanners)
• CI/CD and DevSecOps practices
• Basic knowledge of network security, application security, and cloud security

Preferred Certifications:

• CEH, CompTIA Security+, or equivalent
• Other certifications (e.g., CISSP Associate, GIAC, AWS/Azure Security) are advantageous
• Strong technical troubleshooting and problem-solving skills
• Ability to follow security standards and implement controls effectively
• Good communication skills with technical and non-technical teams
• Detail-oriented with strong documentation skills
• Collaborative team player with willingness to learn