Cybersecurity Engineer (Detection Engineering)

About the role

Assurity Trusted Solutions (ATS), a wholly owned subsidiary of the Government Technology Agency (GovTech), is looking for a Cybersecurity Engineer with a background in detection engineering. The role focuses on developing and tuning detection rules and playbooks for government systems in on-premises and cloud environments, and on analysing security logs and alerts to reduce false positives.

Key responsibilities

• Develop, implement and document security detection rules and playbooks using languages such as Sigma, KQL, SPL, EQL or YARA, depending on the deployed SIEM platform.
• Analyse security logs and alerts from SIEM and EDR systems to distinguish true threats from benign activity and reduce false positives across network, endpoint and cloud security.
• Research threats targeting government networks, endpoints and cloud environments, and continuously tune detection rules and leverage automation.
• Collaborate with security analysts and incident responders on incident response protocols and investigations, and with security engineers on integrating detection systems.
• Maintain up-to-date knowledge of threat TTPs and detection best practices.

Required profile

• Degree in Cybersecurity, Information Security, Computer Science or a related field.
• Relevant certification from OffSec, SANS, GIAC or a related body in cloud security, detection engineering, incident response, malware analysis or penetration testing.
• At least 3 years of experience in security operations, incident response or related fields, with a track record in threat detection and analysis, preferably in an enterprise or government environment.
• Understanding of MITRE ATT&CK and common attacker TTPs.
• Strong analytical, problem-solving and communication skills, and willingness to learn new technologies.

Required skills

• Hands-on experience with SIEM, EDR and SOAR, and scripting languages such as Python and PowerShell.
• Working knowledge of detection rule languages such as Sigma, YARA-L, Splunk SPL, Microsoft KQL or Elastic EQL.
• Experience with version control and a detections-as-code workflow, including peer review and testing detection logic against sample log data.