Security Operations Engineer

MetaComp; Singapore; On-site; SGD 90,000 - 130,000; Full time

Job summary

MetaComp Pte Ltd, a MAS-licensed digital security provider in Singapore, seeks an experienced security operations professional to join its detection engineering and incident response team. You will operate EDR/SIEM/DLP, write detections mapped to MITRE ATT&CK, and lead hands-on incident response while building automation and AI-assisted alerting.

The role offers growth and exposure to cloud security posture reviews.

Qualifications

• 3+ years in security operations, detection engineering or incident response.
• Proficient in Python to automate security tasks.
• Investigates, writes queries, debugs scripts unaided, and explains steps.
• Writes clear incident reports for technical and management readers.
• Writes and maintains IR playbooks and post-incident reviews.

Responsibilities

• Operate and tune EDR, SIEM, DLP and web security gateway: policies, exclusions, agent and log-source health, and detection coverage.
• Write and tune SIEM detections as code, mapped to MITRE ATT&CK.
• Work incidents hands-on (scoping, containment, evidence handling); write and maintain IR playbooks and post-incident reviews.
• Run hypothesis-driven threat hunts; turn hunt results into detections.
• Build automation (SOAR playbooks, workflow-automation flows or Python scripts) for alert enrichment and containment.

Skills

Python

Incident response

Threat detection

SIEM

Tools

EDR

SIEM

DLP

SOAR

Job description

MetaComp Pte Ltd is a leading Singapore-based digital payment solution provider, licensed and regulated by the Monetary Authority of Singapore (MAS) as a Major Payment Institution, to provide Digital Payment Token Services and Cross-border Payment Transfers. Operating under a P2B2C (platform-to-business, partners-to-clients) model, MetaComp provides its clients with an integrated end-to-end suite of services, empowering them to confidently enter the digital asset market with much-needed safety, security, and compliance assurance. Together with its parent company, Metaverse Green Exchange Pte. Ltd. (a MAS-licensed CMS holder permitted to carry out, inter alia, brokerage and custody services), MetaComp introduces its suite of services through CAMP (Client Assets Management Platform) which allow businesses to develop and scale their digital asset offerings through various products and/or services such as over-the-counter transactions, fiat payments, digital asset custody and prime brokerage.

Role summary

Operates EDR, SIEM and DLP, and works hands-on in detection engineering, incident response, automation, threat hunting and vulnerability assessment.

• Operate and tune EDR, SIEM, DLP and web security gateway: policies, exclusions, agent and log-source health, and detection coverage.
• Write and tune SIEM detections as code, mapped to MITRE ATT&CK.
• Work incidents hands-on (scoping, containment, evidence handling); write and maintain IR playbooks and post-incident reviews.
• Run hypothesis-driven threat hunts; turn hunt results, threat intelligence and incident lessons into detections.
• Build automation (SOAR playbooks, workflow-automation flows or Python scripts against REST APIs) for alert enrichment, containment and ticketing.
• Build AI-assisted alert triage.
• Run authenticated vulnerability scans and validate findings; run basic infrastructure and network penetration tests and retest fixes.
• Work with the cloud infrastructure security engineer on cloud logging and detection coverage.
• Track vulnerabilities from your scans to closure; support email security (SPF, DKIM, DMARC) and cloud security posture (CNAPP) reviews.
• Keep detection, incident and scan records as audit evidence.

Requirements

General

• At least 3 years in security operations, detection engineering or incident response.
• Programs in Python to automate security work and build tooling.
• Investigates, writes queries and debugs scripts unaided, and can explain each step.
• Writes clear incident reports for technical and management readers; keeps stakeholders updated during incidents.
• Works independently and owns an area end to end.
• Checks their own work and stands behind it.

Technical

• EDR and SIEM operation: has tuned production policies and exclusions.
• SIEM detection engineering: has written and tuned rules and queries mapped to MITRE ATT&CK, including from threat intelligence, and reduced false positives.
• Incident response: has worked real incidents hands-on (scoping, containment, evidence handling) and contributed to IR playbooks and post-incident reviews.
• Threat hunting: has run, or can design, a hypothesis-driven hunt (hypothesis, data sources, what to look for).
• Automation: Python against REST APIs (authentication, pagination, error handling); has built SOAR playbooks, workflow-automation flows or scripts used in production.
• AI-assisted work: checks AI output critically and catches wrong answers.
• Vulnerability assessment: has run authenticated scans and separated real exposure from false positives.

Nice to have

• DLP policy tuning (endpoint, email, web or cloud), or web security gateway policy.
• Detections as code: version control with peer review and testing.
• Digital forensics (disk and memory) or malware analysis.
• Built AI/LLM security automation (e.g. agent loops, test harnesses).
• Infrastructure and network penetration testing, or red team exercises.
• Cloud detection and response (audit logs, native threat detection).
• Vulnerability management, email security (SPF, DKIM, DMARC), or cloud security posture (CNAPP).
• Working with an MDR or MSSP provider.
• Certifications (e.g. CISSP, OSCP, GCIH, GCIA, GCFA).

We are committed to creating an inclusive workplace where every individual feels respected, valued, and empowered to contribute. We celebrate diversity in all its forms—background, ethnicity, gender, identity, orientation, experience, and thought—and believe it strengthens our culture and our work. We are proud to be an equal opportunity employer and do not discriminate on the basis of race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, disability, or any other protected characteristic.