IT Security Engineer

Role:

The IT Security Engineer will be responsible for implementing, operating, and supporting security controls for mission-critical systems within a secured environment.

This role covers both:

•                      Day 1 Security (Build / Project Implementation)

•                      Day 2 Security (Operations / Production Support)

•                      The Security Engineer will work closely with Security Leads, Infra, System, and Software teams to ensure compliance with government security policies and standards.

Responsibilities:

Day 1 – Project / Implementation Security

1. Security Implementation & Engineering

•                      Implement security architecture and controls as designed by Security Leads/Architects

•                      Support system, application, and infrastructure security configurations

•                      Assist in threat modelling and risk assessment activities

•                      Translate security requirements into technical implementation across platforms

2. Compliance Support

•                      Support compliance with:

•                      IM8 / Government security policies

•                      Whole of Government (WOG) security requirements

•                      PDPA (where applicable)

•                      Assist in preparation and documentation for:

•                      Security Risk Assessments (SRA)

•                      Vulnerability Assessments (VA)

•                      Penetration Testing (PT)

•                      Maintain security documentation and evidence for audits

3. DevSecOps & Secure Development

•                      Implement and maintain security tools in CI/CD pipelines:

•                      SAST, DAST, SCA, container scanning

•                      Monitor and triage findings, and work with developers on remediation

•                      Support secure coding practices and DevSecOps adoption

•                      Assist in API security, secrets management, and secure communications setup

4. Security Testing Support

•                      Support coordination and execution of VA/PT activities

•                      Track vulnerabilities and ensure timely remediation

•                      Assist in documenting findings and closure evidence

•                      Support system security certification and go-live requirements

5. System & Platform Hardening

•                      Implement and maintain security hardening for:

•                      Operating systems

•                      Middleware and databases

•                      Kubernetes and containers (RBAC, secrets, network policies)

•                      Support configuration of:

•                      API Gateways

•                      WAF

•                      Authentication and authorization mechanisms (OAuth2, mTLS)

Day 2 – Operations / Production Security

1. Incident Response

•                      Support investigation, containment, and remediation of security incidents

•                      Perform log analysis and assist in root cause analysis (RCA)

•                      Work with SOC and internal teams during incidents

•                      Follow and improve incident response playbooks

2. Vulnerability & Patch Management

•                      Perform regular vulnerability scans and monitoring

•                      Track and verify patching and remediation activities

•                      Escalate high-risk vulnerabilities and propose mitigation controls

3. Security Monitoring

•                      Monitor alerts from SIEM and security tools

•                      Assist in tuning detection rules and dashboards

•                      Ensure logging and monitoring coverage across systems

4. Audit & Compliance Support

•                      Support audit preparation, evidence collection, and remediation tracking

•                      Maintain security records and documentation

•                      Assist in reporting security posture and issues

5. Access Control Administration

•                      Support implementation of:

•                      RBAC

•                      MFA

•                      Privileged Access Management (PAM)

•                      Perform user access reviews and ensure least privilege

Required Skills:

•                      Degree in Computer Science / Cybersecurity / Information Security or equivalent

•                      3–7 years of IT experience in cybersecurity or infrastructure security

•                      Experience supporting security in projects or production environments

•                      Familiarity with Singapore Government security policies (IM8 preferred)

•                      Hands-on experience with:

•                      Kubernetes / Docker security

•                      IAM and access control

•                      Security tools (SAST, DAST, SIEM, vulnerability scanners)

•                      CI/CD and DevSecOps practices

•                      Basic knowledge of network security, application security, and cloud security

Preferred Certifications:

•                      CEH, CompTIA Security+, or equivalent

•                      Other certifications (e.g., CISSP Associate, GIAC, AWS/Azure Security) are advantageous

Key Competencies:

•                      Strong technical troubleshooting and problem-solving skills

•                      Ability to follow security standards and implement controls effectively

•                      Good communication skills with technical and non-technical teams

•                      Detail-oriented with strong documentation skills

•                      Collaborative team player with willingness to learn