The posting
Department: CISO Office Location: Singapore Experience: 8+ years preferred
Role Overview
We are seeking a hands-on Security Data & Detection Engineer to build and enhance our next-generation, AI-driven Security Operations Centre (Agentic SOC) supporting telecommunications Critical Information Infrastructure (CII).
The role focuses on security data engineering, real-time threat detection, security analytics and proactive threat hunting to defend against sophisticated Advanced Persistent Threats (APTs).
Key Responsibilities
- Security Data Engineering: Design and maintain telemetry ingestion pipelines using Axoflow/Cribl or equivalent technologies, integrating security logs across network, endpoint, identity, cloud and telecommunications environments.
- Data Enrichment and Analytics: Implement parsing, normalisation, enrichment and correlation of security telemetry using ECS/OCSF schemas and relevant asset, identity and threat intelligence context.
- Security Data Platform: Develop and optimise Elasticsearch, Kibana and Elastic Security for scalable security analytics, detection and historical threat hunting.
- Detection Engineering: Develop in-stream and SIEM detection rules, behavioural analytics and correlation logic targeting APT techniques, including lateral movement, credential abuse and living-off-the-land activity.
- Threat Hunting: Develop and execute threat-hunting queries, investigate suspicious patterns and translate emerging threat intelligence into actionable detections.
- Detection Validation: Work with MDR specialists to validate detections through adversary emulation, purple teaming and continuous tuning.
- Agentic SOC Integration: Enable secure access to security telemetry and detection outputs for AI investigation agents.
Required Skills & Experience
- Strong experience in SIEM engineering, security analytics, detection engineering or security data engineering.
- Hands-on experience with Elasticsearch, Kibana, Elastic Security or comparable SIEM platforms.
- Experience with security log ingestion, parsing, enrichment and data pipelines.
- Proficiency in Python and security query languages such as ES|QL, KQL, SPL or SQL.
- Strong understanding of cybersecurity threats, MITRE ATT&CK, threat hunting and incident investigation.
- Experience designing and troubleshooting production security monitoring solutions.
Ideal Candidate
An experienced SIEM or Detection Engineer with strong security data engineering capabilities who can translate complex threat scenarios into reliable, contextualised detections and security analytics.
