IT Security Engineer

Role: •                The IT Security Engineer will be responsible for implementing, operating, and supporting security controls for mission-critical systems within a secured environment. This role covers both: •                Day 1 Security (Build / Project Implementation) •                Day 2 Security (Operations / Production Support) •                The Security Engineer will work closely with Security Leads, Infra, System, and Software teams to ensure compliance with government security policies and standards. Responsibilities: Day 1 – Project / Implementation Security 1. Security Implementation & Engineering •                Implement security architecture and controls as designed by Security Leads/Architects •                Support system, application, and infrastructure security configurations •                Assist in threat modelling and risk assessment activities •                Translate security requirements into technical implementation across platforms 2. Compliance Support •                Support compliance with: •                IM8 / Government security policies •                Whole of Government (WOG) security requirements •                PDPA (where applicable) •                Assist in preparation and documentation for: •                Security Risk Assessments (SRA) •                Vulnerability Assessments (VA) •                Penetration Testing (PT) •                Maintain security documentation and evidence for audits 3. DevSecOps & Secure Development •                Implement and maintain security tools in CI/CD pipelines: •                SAST, DAST, SCA, container scanning •                Monitor and triage findings, and work with developers on remediation •                Support secure coding practices and DevSecOps adoption •                Assist in API security, secrets management, and secure communications setup 4. Security Testing Support •                Support coordination and execution of VA/PT activities •                Track vulnerabilities and ensure timely remediation •                Assist in documenting findings and closure evidence •                Support system security certification and go-live requirements 5. System & Platform Hardening •                Implement and maintain security hardening for: •                Operating systems •                Middleware and databases •                Kubernetes and containers (RBAC, secrets, network policies) •                Support configuration of: •                API Gateways •                WAF •                Authentication and authorization mechanisms (OAuth2, mTLS) Day 2 – Operations / Production Security 1. Incident Response •                Support investigation, containment, and remediation of security incidents •                Perform log analysis and assist in root cause analysis (RCA) •                Work with SOC and internal teams during incidents •                Follow and improve incident response playbooks 2. Vulnerability & Patch Management •                Perform regular vulnerability scans and monitoring •                Track and verify patching and remediation activities •                Escalate high-risk vulnerabilities and propose mitigation controls 3. Security Monitoring •                Monitor alerts from SIEM and security tools •                Assist in tuning detection rules and dashboards •                Ensure logging and monitoring coverage across systems 4. Audit & Compliance Support •                Support audit preparation, evidence collection, and remediation tracking •                Maintain security records and documentation •                Assist in reporting security posture and issues 5. Access Control Administration •                Support implementation of: •                RBAC •                MFA •                Privileged Access Management (PAM) •                Perform user access reviews and ensure least privilege Required Skills: •                Degree in Computer Science / Cybersecurity / Information Security or equivalent •                3–7 years of IT experience in cybersecurity or infrastructure security •                Experience supporting security in projects or production environments •                Familiarity with Singapore Government security policies (IM8 preferred) •                Hands-on experience with: •                Kubernetes / Docker security •                IAM and access control •                Security tools (SAST, DAST, SIEM, vulnerability scanners) •                CI/CD and DevSecOps practices •                Basic knowledge of network security, application security, and cloud security Preferred Certifications: •                CEH, CompTIA Security+, or equivalent •                Other certifications (e.g., CISSP Associate, GIAC, AWS/Azure Security) are advantageous Key Competencies: •                Strong technical troubleshooting and problem-solving skills •                Ability to follow security standards and implement controls effectively •                Good communication skills with technical and non-technical teams •                Detail-oriented with strong documentation skills •                Collaborative team player with willingness to learn