Cybersecurity Engineer (Security Operations, CIOO)

Assurity Trusted Solutions (ATS) is a wholly owned subsidiary of the Government Technology Agency (GovTech). As a Trusted Partner over the last decade. ATS offers a comprehensive suite of products and services ranging from infrastructure and operational services, governance and assurance services as well as managed processes. In a dynamic digital & cyber landscape where trust & collaboration is key, ATS continues to drive mutually beneficial business outcomes through collaboration with GovTech, government agencies and commercial partners to mitigate cyber risks and bolster security postures.

Responsibilities:

• Monitor and investigate security alerts, suspicious activity, vulnerabilities and incidents across cloud, SaaS, application and infrastructure environments.
• Triage security findings, determine their relevance and severity, identify affected systems and coordinate practical remediation with product and platform teams.
• Drive findings through the full lifecycle from detection to mitigation, evidence collection, risk acceptance where appropriate and formal closure. Maintain clear ownership, due dates and escalation paths.
• Operate and improve attack-surface management, including asset discovery, domain and service exposure, stale or unmanaged assets, ownership tracking and remediation follow-up.
• Manage vulnerability information from security scanners, cloud-security platforms and security alerts. Correlate duplicate findings and focus attention on exploitable attack paths and material risk.
• Support the onboarding and validation of production security logs to central monitoring, including log-source selection, ingestion checks, parsing, coverage evidence and troubleshooting with product teams.
• Operate and improve automated baseline and privileged-activity log review for required monitoring use cases. Tune rules and distinguish meaningful deviations from expected administrative or deployment activity.
• Maintain the Datadog security information and event management (SIEM) platform, including log-source health, parsing, dashboards, alerting and coverage. Write and tune customised detection rules for GovTech-specific security use cases.
• Develop and maintain detection logic, queries, dashboards and alert workflows for cloud and SaaS platforms. Reduce noise while preserving visibility of high-value security signals.
• Support incident response by establishing timelines, collecting relevant evidence, coordinating containment and recovery actions, documenting decisions and confirming that follow-up actions address the underlying cause.
• Build and maintain workflow automation for common incidents and recurring operational tasks, including alert enrichment, team notification, ticket creation, evidence gathering and status reporting.
• Support insider-risk monitoring and related security investigations with appropriate confidentiality, evidence handling, escalation and coordination with relevant stakeholders.
• Maintain operational runbooks, detection documentation, log-source inventories, incident records, lessons learned and metrics for response performance and recurring gaps.