The posting
We're hiring a versatile engineer whose primary focus is IT support and end-user service, backed by hands-on security operations and applied AI. This is a genuine “utility player” role in a lean, modern IT team: most days you're resolving user access, endpoint, and productivity issues and keeping the service desk running to SLA — and, alongside that, you'll triage the occasional EDR detection and build AI agents that automate manual support and analyst workflows.
The split is deliberate and roughly holds week to week:
- IT Support — 40%
- Cyber Security Engineering — 30%
- AI Agent Engineering — 30%
This role works across a CrowdStrike-centric security stack, a Microsoft 365 / Power Platform environment, and a growing ecosystem of Copilot Studio agents. Although the role is based in Singapore, you'll provide remote IT support to users across other regions and time zones.
Key responsibilities:
IT Support (40%)
- Act as an escalation point for L1/L2 support, resolving endpoint, identity, and productivity issues.
- Manage user lifecycle in Entra ID / Microsoft 365 — onboarding, offboarding, access provisioning, and MFA/device issues.
- Own and progress tickets in ServiceNow, meeting SLAs and keeping accurate records.
- Troubleshoot endpoint, network connectivity, VPN, and M365 application problems.
- Provide remote IT support to users in other regions, including Korea, delivering support to Korean-speaking users in their local language and coordinating with local/regional IT teams and smart-hands support to resolve cross-site issues and maintain consistent service standards.
- Provide end-user hardware support — set up, diagnose, and repair/replace user laptops, peripherals, and docking stations, and support office and meeting-room hardware such as projectors, displays, video-conferencing/AV equipment, and printers.
- Support day-to-day Microsoft Purview tasks — applying and troubleshooting sensitivity labels, DLP policies, and retention settings, and assisting with eDiscovery and compliance requests for end users.
- Identify recurring support pain points and propose automation or self-service fixes (this feeds directly into the AI agent work below).
- Contribute to knowledge base articles and user-facing documentation.
Cyber Security Engineering (30%)
- Monitor, triage, and investigate detections across the CrowdStrike Falcon stack (EDR, NG-SIEM, Identity Protection), escalating and containing threats as needed.
- Lead incident response activities — from initial analysis through containment, eradication, and post-incident reporting.
- Build and tune SOAR playbooks (e.g. Falcon Fusion) to automate detection, enrichment, and response workflows.
- Investigate phishing and malware reports, working with email security (Mimecast) and endpoint tooling to remediate.
- Support vulnerability management — running scans (Qualys/Nessus), prioritising findings, and tracking remediation with system owners.
- Maintain and harden security controls across endpoint, identity, network (Fortinet), and email layers.
- Contribute to threat hunting, detection engineering, and continuous improvement of the security posture.
- Produce clear executive and technical reporting on incidents, trends, and security metrics.
AI Agent Engineering (30%)
- Design, build, and maintain agents in Microsoft Copilot Studio, including multi-agent / orchestrator-child-agent architectures.
- Develop automation flows in Power Automate and across the broader Power Platform.
- Integrate agents with enterprise systems (ServiceNow, security tooling, M365) via APIs, custom connectors, and HTTP actions.
- Apply prompt engineering, knowledge-source/RAG configuration, and testing to make agents accurate and reliable.
- Partner with the security and IT teams to identify manual, repetitive workflows and convert them into agentic automations (e.g. incident summarisation, triage assistance, reporting).
- Apply governance, testing, and version-control discipline to agents before they reach production.
- Keep pace with the fast-moving agentic-AI and Agentic SOC landscape and bring practical ideas back to the team.
Required qualifications:
- 3–5 years in a blended IT / security / automation role (or strong equivalent experience).
- Bachelor’s degree in computing, information systems or IT security.
- Solid grounding in cyber security operations: EDR/SIEM concepts, incident triage, phishing/malware investigation, and network security fundamentals.
- Hands-on experience with the Microsoft 365 / Entra ID ecosystem and IT support fundamentals.
- Experience with an ITSM platform (ServiceNow preferred) and working to SLAs.
- Demonstrated ability to build automation — whether via low-code platforms (Power Automate / Copilot Studio), scripting, or API integration.
- Comfortable providing remote support across multiple regions and time zones, coordinating with distributed teams and end users.
- Business-level Korean proficiency (spoken and written) is mandatory. This role directly supports the Korea office and Korean-speaking business users. The candidate must be able to independently provide user support, conduct troubleshooting discussions, prepare documentation, and communicate with local management and the Korea IT team in Korean, in addition to having professional working proficiency in English. Only candidates with professional business Korean language capability should apply.
- Strong troubleshooting, documentation, and communication skills; comfortable working with both technical peers and non-technical end users.
- Self-directed and able to context-switch across three distinct workstreams.
