Information Technology Security Engineer

Role:

The IT Security Engineer will be responsible for implementing, operating, and supporting security controls for mission-critical systems within a secured environment.

This role covers both:

• Day 1 Security (Build / Project Implementation)
• Day 2 Security (Operations / Production Support)
• The Security Engineer will work closely with Security Leads, Infra, System, and Software teams to ensure compliance with government security policies and standards.

Responsibilities:

Day 1 – Project / Implementation Security

1. Security Implementation & Engineering

• Implement security architecture and controls as designed by Security Leads/Architects
• Support system, application, and infrastructure security configurations
• Assist in threat modelling and risk assessment activities
• Translate security requirements into technical implementation across platforms

2. Compliance Support

• Support compliance with:
• IM8 / Government security policies
• Whole of Government (WOG) security requirements
• PDPA (where applicable)
• Assist in preparation and documentation for:
• Security Risk Assessments (SRA)
• Vulnerability Assessments (VA)
• Penetration Testing (PT)
• Maintain security documentation and evidence for audits

3. DevSecOps & Secure Development

• Implement and maintain security tools in CI/CD pipelines:
• SAST, DAST, SCA, container scanning
• Monitor and triage findings, and work with developers on remediation
• Support secure coding practices and DevSecOps adoption
• Assist in API security, secrets management, and secure communications setup

4. Security Testing Support

• Support coordination and execution of VA/PT activities
• Track vulnerabilities and ensure timely remediation
• Assist in documenting findings and closure evidence
• Support system security certification and go-live requirements

5. System & Platform Hardening

• Implement and maintain security hardening for:
• Operating systems
• Middleware and databases
• Kubernetes and containers (RBAC, secrets, network policies)
• Support configuration of:
• API Gateways
• WAF
• Authentication and authorization mechanisms (OAuth2, mTLS)

Day 2 – Operations / Production Security

1. Incident Response

• Support investigation, containment, and remediation of security incidents
• Perform log analysis and assist in root cause analysis (RCA)
• Work with SOC and internal teams during incidents
• Follow and improve incident response playbooks

2. Vulnerability & Patch Management

• Perform regular vulnerability scans and monitoring
• Track and verify patching and remediation activities
• Escalate high-risk vulnerabilities and propose mitigation controls

3. Security Monitoring

• Monitor alerts from SIEM and security tools
• Assist in tuning detection rules and dashboards
• Ensure logging and monitoring coverage across systems

4. Audit & Compliance Support

• Support audit preparation, evidence collection, and remediation tracking
• Maintain security records and documentation
• Assist in reporting security posture and issues

5. Access Control Administration

• Support implementation of:
• RBAC
• MFA
• Privileged Access Management (PAM)
• Perform user access reviews and ensure least privilege

Required Skills:

• Degree in Computer Science / Cybersecurity / Information Security or equivalent
• 3–7 years of IT experience in cybersecurity or infrastructure security
• Experience supporting security in projects or production environments
• Familiarity with Singapore Government security policies (IM8 preferred)
• Hands-on experience with:
• Kubernetes / Docker security
• IAM and access control
• Security tools (SAST, DAST, SIEM, vulnerability scanners)
• CI/CD and DevSecOps practices
• Basic knowledge of network security, application security, and cloud security

Preferred Certifications:

• CEH, CompTIA Security+, or equivalent
• Other certifications (e.g., CISSP Associate, GIAC, AWS/Azure Security) are advantageous

Key Competencies:

• Strong technical troubleshooting and problem-solving skills
• Ability to follow security standards and implement controls effectively
• Good communication skills with technical and non-technical teams
• Detail-oriented with strong documentation skills
• Collaborative team player with willingness to learn