IT Security Engineer

Role:

• The IT Security Engineer will be responsible for implementing, operating, and supporting security controls for mission-critical systems within a secured environment.

This role covers both:

• Day 1 Security (Build / Project Implementation)

• Day 2 Security (Operations / Production Support)

• The Security Engineer will work closely with Security Leads, Infra, System, and Software teams to ensure compliance with government security policies and standards.

Responsibilities:

Day 1 – Project / Implementation Security

1. Security Implementation & Engineering

• Implement security architecture and controls as designed by Security Leads/Architects

• Support system, application, and infrastructure security configurations

• Assist in threat modelling and risk assessment activities

• Translate security requirements into technical implementation across platforms

2. Compliance Support

• Support compliance with:

• IM8 / Government security policies

• Whole of Government (WOG) security requirements

• PDPA (where applicable)

• Assist in preparation and documentation for:

• Security Risk Assessments (SRA)

• Vulnerability Assessments (VA)

• Penetration Testing (PT)

• Maintain security documentation and evidence for audits

3. DevSecOps & Secure Development

• Implement and maintain security tools in CI/CD pipelines:

• SAST, DAST, SCA, container scanning

• Monitor and triage findings, and work with developers on remediation

• Support secure coding practices and DevSecOps adoption

• Assist in API security, secrets management, and secure communications setup

4. Security Testing Support

• Support coordination and execution of VA/PT activities

• Track vulnerabilities and ensure timely remediation

• Assist in documenting findings and closure evidence

• Support system security certification and go-live requirements

5. System & Platform Hardening

• Implement and maintain security hardening for:

• Operating systems

• Middleware and databases

• Kubernetes and containers (RBAC, secrets, network policies)

• Support configuration of:

• API Gateways

• WAF

• Authentication and authorization mechanisms (OAuth2, mTLS)

Day 2 – Operations / Production Security

1. Incident Response

• Support investigation, containment, and remediation of security incidents

• Perform log analysis and assist in root cause analysis (RCA)

• Work with SOC and internal teams during incidents

• Follow and improve incident response playbooks

2. Vulnerability & Patch Management

• Perform regular vulnerability scans and monitoring

• Track and verify patching and remediation activities

• Escalate high-risk vulnerabilities and propose mitigation controls

3. Security Monitoring

• Monitor alerts from SIEM and security tools

• Assist in tuning detection rules and dashboards

• Ensure logging and monitoring coverage across systems

4. Audit & Compliance Support

• Support audit preparation, evidence collection, and remediation tracking

• Maintain security records and documentation

• Assist in reporting security posture and issues

5. Access Control Administration

• Support implementation of:

• RBAC

• MFA

• Privileged Access Management (PAM)

• Perform user access reviews and ensure least privilege

Required Skills:

• Degree in Computer Science / Cybersecurity / Information Security or equivalent

• 3–7 years of IT experience in cybersecurity or infrastructure security

• Experience supporting security in projects or production environments

• Familiarity with Singapore Government security policies (IM8 preferred)

• Hands-on experience with:

• Kubernetes / Docker security

• IAM and access control

• Security tools (SAST, DAST, SIEM, vulnerability scanners)

• CI/CD and DevSecOps practices

• Basic knowledge of network security, application security, and cloud security

Preferred Certifications:

• CEH, CompTIA Security+, or equivalent

• Other certifications (e.g., CISSP Associate, GIAC, AWS/Azure Security) are advantageous

Key Competencies:

• Strong technical troubleshooting and problem-solving skills

• Ability to follow security standards and implement controls effectively

• Good communication skills with technical and non-technical teams

• Detail-oriented with strong documentation skills

• Collaborative team player with willingness to learn