Cybersecurity Engineer (Security Operations, CIOO)

About the role

Assurity Trusted Solutions (ATS), a wholly owned subsidiary of the Government Technology Agency (GovTech), is hiring a Cybersecurity Engineer for its Security Operations team. The role covers monitoring, triaging and investigating security alerts, vulnerabilities and incidents across cloud, SaaS, application and infrastructure environments, and driving findings through to remediation and closure.

Key responsibilities

• Monitor and investigate security alerts, suspicious activity, vulnerabilities and incidents across cloud, SaaS, application and infrastructure environments.
• Triage findings, determine relevance and severity, identify affected systems and coordinate remediation with product and platform teams.
• Drive findings through detection, evidence collection, risk acceptance and formal closure, with clear ownership, due dates and escalation paths.
• Manage attack-surface and vulnerability information, correlate duplicate findings and focus on exploitable attack paths.
• Support onboarding and validation of production security logs, and tune automated baseline and privileged-activity log reviews.
• Maintain the Datadog SIEM platform, write and tune customised detection rules, and build detection logic, queries, dashboards and alert workflows for cloud and SaaS platforms.
• Support incident response, establish timelines, collect evidence, coordinate containment and recovery, and document decisions.
• Build workflow automation for common incidents and recurring tasks, support insider-risk monitoring and investigations, and maintain runbooks, incident records and lessons learned.

Required profile

• Hands-on experience in security operations, incident response, detection engineering, cloud security, vulnerability management or attack-surface management.
• Practical experience with Wiz and Tenable, or directly comparable cloud-security and vulnerability-management platforms.
• Strong log-analysis skills and understanding of alerts, indicators of compromise, authentication activity and network or application behaviour.
• Ability to assess whether a finding is real, a false positive, an expected condition or a symptom of a wider control weakness.
• Good written communication and coordination skills, and comfort improving processes through automation while keeping human review for incident command and risk decisions.

Required skills

• AWS, Microsoft Azure, Google Cloud, Microsoft 365, Google Workspace or other cloud and SaaS platforms.
• Wiz, Tenable, Datadog SIEM, Elastic, Microsoft Sentinel, Chronicle, Splunk, Defender, GuardDuty or comparable platforms.
• Incident-response case management, ticketing, security orchestration and automated response workflows.
• Query languages such as KQL, SQL or Python.
• Certifications such as Security+, CySA+, GCIH, GCDA or SC-200 are useful but do not replace investigation ability.

What we offer

• Remuneration commensurate with qualifications and experience.
• A learning culture with opportunities to grow and learn.
• Benefits for contract staff equal to those of permanent employees.