Cybersecurity Operations Engineer (CIO Office)

About the role

Assurity Trusted Solutions (ATS), a wholly owned subsidiary of the Government Technology Agency (GovTech), is hiring a Cybersecurity Operations Engineer for its CIO Office. The role covers monitoring, triaging and closing security alerts and incidents across cloud, SaaS, application and infrastructure environments, and improving detection, log monitoring and incident response.

Key responsibilities

• Monitor and investigate security alerts, suspicious activity, vulnerabilities and incidents across cloud, SaaS, application and infrastructure environments.
• Triage findings, assess severity, identify affected systems and coordinate remediation with product and platform teams, driving each finding through detection, evidence collection, risk acceptance and closure.
• Manage attack-surface activities: asset discovery, domain and service exposure, stale or unmanaged assets, ownership tracking and remediation follow-up.
• Correlate vulnerability scanner and cloud-security platform findings and focus on exploitable attack paths and material risk.
• Support onboarding and validation of production security logs, including log-source selection, ingestion checks, parsing and coverage evidence.
• Run and tune automated baseline and privileged-activity log reviews, and tune Datadog SIEM log sources, dashboards, alerting and custom detection rules.
• Build detection logic, queries, dashboards and alert workflows for cloud and SaaS platforms, reducing noise while keeping high-value signals visible.
• Support incident response: timelines, evidence collection, containment and recovery coordination, and follow-up actions.
• Build workflow automation for common incidents and recurring tasks, including alert enrichment, notifications, ticket creation and status reporting.
• Support insider-risk monitoring and investigations, and maintain runbooks, detection documentation, log inventories, incident records, lessons learned and metrics.

Required profile

• Experience with incident-response case management, ticketing, security orchestration and automated response workflows.
• Experience analysing security logs, onboarding log sources, validating coverage, normalising events, tuning detections or maintaining detection-as-code practices.
• Experience with vulnerability scanners, cloud-security platforms, vulnerability-management workflows and attack-surface management.
• Certifications such as Security+, CySA+, GCIH, GCDA or SC-200 are useful but do not replace investigation ability.

Required skills

• AWS, Microsoft Azure, Google Cloud, Microsoft 365, Google Workspace or other cloud and SaaS platforms.
• Wiz, Tenable, Datadog SIEM, Elastic, Microsoft Sentinel, Chronicle, Splunk, Defender, GuardDuty or comparable platforms.

What we offer

• Remuneration commensurate with qualifications and experience.
• Benefits for contract staff equal to those of permanent employees.
• A learning culture within a wholly owned GovTech subsidiary.