Security Engineer (SIEM & SOAR)

XCELLINK PTE. LTD.; Singapore; On-site; SGD 80,000 - 120,000; Full time

Job summary

XCELLINK PTE. LTD. in Singapore seeks a Security Engineer (SIEM & SOAR) to join our Cyber Security team.

You will implement, maintain, and enhance security monitoring and automation using Elastic SIEM and Tines SOAR to strengthen threat detection and incident response. Ideal candidates have hands-on security operations experience, threat monitoring, and automation skills, and are eager to deepen expertise in modern SOC technologies.

Qualifications

• Minimum 2 years in Cyber Security, SOC operations, SIEM engineering, or security automation.
• Hands-on experience with Elastic SIEM mandatory.
• Hands-on experience with Tines SOAR mandatory.
• Experience developing detection rules, correlation logic, dashboards, and use cases.
• Experience building automated incident response playbooks.

Responsibilities

• Administer, maintain, and optimize Elastic SIEM environments.
• Develop, tune, and maintain detection rules, alerts, dashboards, and use cases within Elastic.
• Design, build, and maintain security automation workflows and playbooks using Tines SOAR.
• Integrate security tools into Tines workflows (EDR, email security, vulnerability management, threat intel).
• Investigate alerts, perform root cause analysis, and recommend remediation.
• Support SIEM onboarding: log source integration, parsing, normalization, data validation.
• Create and maintain docs for monitoring, automation, and procedures.
• Collaborate with customers and internal teams to deliver requirements.
• Troubleshoot and resolve SIEM and SOAR platform issues.

Skills

Security Operations

Incident Response

Threat Monitoring

Automation

Troubleshooting

Tools

Elastic SIEM

Tines SOAR

Python

PowerShell

EDR

Threat Intelligence Platforms

Job description

We are seeking a Security Engineer (SIEM & SOAR) to join our Cyber Security team. The successful candidate will be responsible for implementing, maintaining, and enhancing security monitoring and automation capabilities using Elastic SIEM and Tines SOAR.

This role is ideal for candidates with hands-on experience in security operations, detection engineering, threat monitoring, incident response, and security automation who are looking to deepen their expertise in modern Security Operations Centre (SOC) technologies.

Key Responsibilities

• Administer, maintain, and optimize Elastic SIEM environments.
• Develop, tune, and maintain detection rules, alerts, dashboards, and use cases within Elastic.
• Design, build, and maintain security automation workflows and playbooks using Tines SOAR.
• Integrate security tools such as EDR, email security, vulnerability management, and threat intelligence platforms into Tines workflows.
• Investigate security alerts and incidents, perform root cause analysis, and recommend remediation actions.
• Support SIEM onboarding activities, including log source integration, parsing, normalization, and data validation.
• Create and maintain documentation for security monitoring, automation workflows, and operational procedures.
• Collaborate with customers and internal cyber security teams to deliver project and operational requirements.
• Perform troubleshooting and resolution of SIEM and SOAR platform issues.
• Support continuous improvement initiatives to enhance detection coverage and operational efficiency.

Mandatory Requirements

• Minimum 2 years of experience in Cyber Security, SOC Operations, SIEM Engineering, or Security Automation.
• Hands-on experience with Elastic SIEM (mandatory).
• Hands-on experience with Tines SOAR (mandatory).
• Experience developing detection rules, correlation logic, dashboards, and threat monitoring use cases.
• Experience building and maintaining automation workflows and incident response playbooks.
• Knowledge of security operations, incident management, and cyber security best practices.
• Familiarity with Windows and Linux operating systems.
• Basic understanding of networking concepts including TCP/IP, DNS, VPN, and firewall technologies.
• Good troubleshooting and analytical skills.
• Strong communication and documentation skills.

Preferred Qualifications

• Experience with Python, PowerShell, or scripting for automation.
• Exposure to EDR, DLP, IAM/PAM, Vulnerability Management, or Threat Intelligence platforms.
• Familiarity with MITRE ATT&CK framework and threat hunting practices.
• Experience working in a SOC, MSSP, or cyber security consulting environment.
• Security certifications such as Security+, CEH, SSCP, Elastic Certified Analyst, or equivalent.