The posting
Department: CISO Office Location: Singapore Experience: 8+ years preferred
Role Overview
We are seeking a hands-on Security Automation Engineer to develop AI-driven security investigation and response capabilities for our Agentic SOC.
The role combines software engineering, cybersecurity operations and agentic AI to automate threat intelligence analysis, detection engineering, threat hunting, security investigations and incident response workflows.
The engineer will leverage Elastic Security, privately hosted LLMs and secure integrations with enterprise security tools to accelerate investigations and strengthen defence against sophisticated APTs.
Key Responsibilities
- Agentic AI Engineering: Develop AI agents and automated workflows using Elastic Security AI capabilities, agent orchestration frameworks and LLM tool calling.
- Security Investigation Automation: Build workflows for alert triage, evidence correlation, attack timeline reconstruction and incident prioritisation.
- Threat Intelligence and Detection Engineering: Develop AI-assisted workflows to analyse emerging threats, generate detection rules, test analytics and support proactive threat hunting.
- Security Integration: Integrate agents with Elasticsearch, EDR, IAM/PAM, network security systems and threat intelligence platforms using Python, APIs and MCP where appropriate.
- Incident Response and Forensics: Automate targeted forensic collection and threat-hunting workflows using tools with appropriate approval controls.
- Sovereign AI: Integrate privately hosted LLM inference services to enable secure processing of sensitive CII telemetry.
- Agent Security and Reliability: Implement access controls, audit logging, automated testing, agent evaluations and safeguards against unauthorised actions.
- Operational Collaboration: Work with MDR and IR specialists to continuously improve automated detection, investigation and response capabilities.
Required Skills & Experience
- Strong Python development and API integration experience.
- Experience developing security automation, SOAR workflows or security-focused software applications.
- Practical experience with LLM APIs, AI agents, tool calling or orchestration frameworks.
- Understanding of SIEM, EDR/XDR, threat detection, threat hunting and incident response.
- Familiarity with Elasticsearch, Elastic Security or comparable analytics platforms.
Ideal Candidate
A security-focused software engineer with strong automation skills and practical AI-agent development experience, capable of translating cybersecurity investigation methodologies into secure, reliable and scalable automated workflows.
