We are seeking a skilled ICT Security Engineer to join the Production Security team of a leading financial institution in Singapore. This role is focused on strengthening the bank's ability to detect and respond to cyber threats through the deployment, maintenance, and continuous improvement of its SIEM infrastructure.

While the broader team manages security infrastructure, this specific role is primarily focused on the operational stability and troubleshooting of the Logstash ingestion layer within the bank's SIEM platform.

The day-to-day work involves maintaining Logstash servers, troubleshooting pipeline failures, investigating ingestion issues on Linux servers, and writing Python/Bash scripts for automation. You will work closely with Production Infrastructure and Observability teams to ensure logs from thousands of servers flow seamlessly into the ELK platform.

The successful candidate will be a full-time member of the Production CSIRT / SIEM Engineering team, with opportunities to expand the scope of activities within the team.

This role requires deep technical expertise in Logstash, Linux administration, and scripting (Python or Bash) , with a strong focus on production support and platform management. The ideal candidate is rigorous, self-driven, and comfortable working autonomously in a fast-paced environment.

Main Responsibilities

Core Responsibilities (Day-to-Day)

Troubleshoot Logstash production pipelines, including identifying and resolving ingestion failures.
Investigate why client servers are not sending data to Logstash, and restore data flow.
Perform health checks on Linux servers — checking service status (systemctl), analyzing logs, and investigating CPU/memory/disk issues.
Restart and reconfigure Logstash services safely in production environments.
Develop Python or Bash scripts for automation, log parsing, and operational tasks.
Support log parsing using custom parser development and GROK.

Platform Management

Install, configure, and administer servers within the SIEM infrastructure.
Manage project deliverables and contribute to platform improvements.
Platform integration skills, including installation, configuration, documentation, and administration of pre-production and production platforms.

Compliance & Governance

Contribute to the Permanent Control framework by implementing policies and procedures in day-to-day business activities, such as the Control Plan.
Comply with regulatory requirements and internal guidelines.
Contribute to the reporting of all incidents according to the Incident Management System.

Qualifications & Experience

Mandatory (Must-Have)

Hands-on production experience with Logstash — including troubleshooting pipelines, ingestion failures, and service management.
Proficient in Linux administration (RedHat / Ubuntu) — comfortable working directly on Linux servers, checking logs, managing services, and investigating resource issues.
Minimum 2 years of scripting/programming experience in Python or Bash — used for automation, log parsing, and operational scripting.
Production-grade experience with the broader Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) , including data ingestion, indexing, monitoring, and analytics.
Strong hands-on experience with Kafka.
Proven background in production support across both virtual and physical environments.
Bachelor's Degree in Information Technology or a related field.
Minimum 7 years of total professional experience, with at least 4–5 years focused on large-scale Elastic Stack (ELK) design, deployment, and support.

Preferred (Nice-to-Have)

Experience with automation/orchestration tools (e.g., Ansible or equivalent) and CI/CD pipelines.
Platform integration skills, including installation, configuration, documentation, and administration of pre-production and production platforms.
Banking sector experience is optional but regarded as a plus.

Personal Attributes

Rigorous and detail-oriented approach to work.
Strong analytical and problem-solving skills.
Self-driven — able to work autonomously and take ownership of tasks.
Excellent communication skills and a collaborative team player.
High energy, proactive attitude, and a willingness to upskill.
Ability to manage multiple priorities simultaneously.

ICT Security Engineer (ELK Platform)