Senior Security Data & Detection Engineer

Simba Telecom Pte. Ltd.; Singapore; On-site; SGD 90,000 - 150,000; Full time

Job summary

Simba Telecom Pte. Ltd. in Singapore is seeking a hands-on Security Data & Detection Engineer to bolster our AI-driven Agentic SOC, protecting critical telecom infrastructure.

The role centers on security data engineering, real-time threat detection, analytics and proactive threat hunting across network, endpoint, identity and cloud environments. Ideal candidates bring strong SIEM and Elastic Stack experience, Python, and the ability to translate complex threats into reliable detections for

Qualifications

• Experience in SIEM engineering and security analytics.
• Hands-on with Elasticsearch, Kibana, Elastic Security.
• Proficiency in Python and security query languages (ES|QL, KQL, SPL or SQL).

Responsibilities

• Security Data Engineering: design and maintain telemetry ingestion pipelines.
• Data Enrichment and Analytics: parsing, enrichment, correlation of security telemetry.
• Security Data Platform: develop and optimize Elasticsearch and Kibana for analytics.
• Detection Engineering: build in-stream detection rules and behavior analytics.
• Threat Hunting: run threat-hunting queries and translate intel into detections.
• Detection Validation & Integration: validate detections with MDR and integrate outputs

Skills

SIEM engineering

Security analytics

Detection engineering

Security data engineering

Python

ES|QL / KQL / SPL / SQL

Threat hunting

Incident investigation

Production monitoring

Tools

Elasticsearch

Kibana

Elastic Security

Job description

Department:CISO Office
Location:Singapore
Experience:8+ years preferred

Role Overview

We are seeking a hands-on Security Data & Detection Engineer to build and enhance our next‑generation, AI‑driven Security Operations Centre (Agentic SOC) supporting telecommunications Critical Information Infrastructure (CII).

The role focuses on security data engineering, real‑time threat detection, security analytics and proactive threat hunting to defend against sophisticated Advanced Persistent Threats (APTs).

Key Responsibilities

• Security Data Engineering:Design and maintain telemetry ingestion pipelines using Axoflow/Cribl or equivalent technologies, integrating security logs across network, endpoint, identity, cloud and telecommunications environments.

• Data Enrichment and Analytics:Implement parsing, normalisation, enrichment and correlation of security telemetry using ECS/OCSF schemas and relevant asset, identity and threat intelligence context.

• Security Data Platform:Develop and optimise Elasticsearch, Kibana and Elastic Security for scalable security analytics, detection and historical threat hunting.

• Detection Engineering:Develop in-stream and SIEM detection rules, behavioural analytics and correlation logic targeting APT techniques, including lateral movement, credential abuse and living-off-the-land activity.

• Threat Hunting:Develop and execute threat-hunting queries, investigate suspicious patterns and translate emerging threat intelligence into actionable detections.

• Detection Validation:Work with MDR specialists to validate detections through adversary emulation, purple teaming and continuous tuning.

• Agentic SOC Integration:Enable secure access to security telemetry and detection outputs for AI investigation agents.

Required Skills & Experience

• Strong experience in SIEM engineering, security analytics, detection engineering or security data engineering.

• Hands‑on experience with Elasticsearch, Kibana, Elastic Security or comparable SIEM platforms.

• Experience with security log ingestion, parsing, enrichment and data pipelines.

• Proficiency in Python and security query languages such as ES|QL, KQL, SPL or SQL.

• Strong understanding of cybersecurity threats, MITRE ATT&CK, threat hunting and incident investigation.

• Experience designing and troubleshooting production security monitoring solutions.

Ideal Candidate

An experienced SIEM or Detection Engineer with strong security data engineering capabilities who can translate complex threat scenarios into reliable, contextualised detections and security analytics.