I52 - Security Analyst (120)
Hands-on security analyst role (via FPT Software, embedded in Income Insurance's IT Risk and Security team) administering and tuning enterprise security tools — Google SecOps SIEM, EDR, NTA/Gigamon, IPS, DAM — across on-prem and cloud. Day to day: detection tuning, threat containment with the managed SOC, automation, reporting, and vendor/project management under MAS TRM governance.
- Compensation
- Not disclosed
- Location
- Singapore
- Work setup
- Onsite
- Seniority
- Not specified
- Employment
- Contract
- Experience
- 4+ years
- Category
- Security
- Posted
Skills
Must have
- Bachelor's degree in Cybersecurity, IT, Computer Science or related discipline, preferably in Financial Services or a regulated environment
- Minimum 4 years hands-on experience administering enterprise security tools in a medium-to-large enterprise
- Experience with EDR policy configuration, sensor deployment, health monitoring, exclusion management, prevention tuning and host containment
- Experience with NTA and Gigamon or similar network packet brokers (traffic mirroring, TAP config, sensor placement, traffic decryption, anomaly investigation)
- Good knowledge of IT network security (LAN, WAN, vLAN, MPLS, network zoning, micro-segmentation) and AI/ML-enabled security tools
- High proficiency in Unix/Linux, Mac and Windows plus virtualisation (VMware, Hyper-V); working knowledge of AWS, Azure or Google Cloud security
- Scripting (Python, PowerShell), APIs and automation/SOAR tools to integrate security controls
- Familiarity with change, access, configuration and vendor-management processes
- Strong written and verbal communication skills for technical and non-technical audiences
- Strong analytical and troubleshooting skills, able to work under pressure and during security incidents
Nice to have
- Experience administering Google Security Operations SIEM (log-source onboarding, parsing, detection rule tuning, dashboards, reporting)
- Experience with IPS, Proxy and firewalls
- Knowledge of MAS TRM Guidelines, MAS Cyber Hygiene Notice, NIST Cybersecurity Framework and MITRE ATT&CK
- Certifications such as CISSP, CISM, CISA, GIAC (GCIA, GCED), CCSP, PMP or vendor certifications for SIEM, EDR or network visibility tools
Full description
Description
The Security Analyst is responsible for administering, maintaining and continuously improving the security controls of Income Insurance Limited's (Income) enterprise security tools, including the Google Security Operations (SecOps) platform, Network Traffic Analysis (NTA) and Gigamon visibility tools, and Endpoint Detection and Response (EDR). The role ensures these platforms remain healthy, correctly configured and tuned to detect and contain current and emerging cyber threats across on-premises, cloud and hybrid environments. He/She will also lead security tool integration, technology refresh and improvement projects, working closely with IT infrastructure and application teams, business units, the managed SOC and product vendors to protect Income's confidential information.
This security systems administration and operations role sits within the IT Risk and Security Department and reports to the Security Operations Manager.
Key Responsibilities
-
Security tool administration: Administer, configure and maintain Income's security tools, including Google SecOps, NTA and Gigamon tools, EDR, Intrusion Prevention System (IPS) and Database Activity Monitoring (DAM). This covers policy and rule configuration, agent and sensor deployment, log-source onboarding, user access management, upgrades, patching, and health and availability monitoring.
-
Control improvement and tuning: Continuously review and improve tool configurations, detection rules, prevention policies and exclusions to reduce false positives, close detection gaps and align controls with the MITRE ATT&CK framework and current threat intelligence.
-
Visibility and coverage: Ensure complete and reliable security telemetry for on-premises and cloud assets by onboarding new log sources, endpoints and network segments, validating data quality, parsing and retention, and tracking coverage gaps to closure.
-
Threat detection and containment: Support the managed SOC and incident response team by using SIEM, EDR and NTA capabilities to investigate, isolate and contain threats, and implement control improvements arising from incidents, red team exercises, table-tops and post-incident reviews.
-
Security control assessment: Analyse, assess and evaluate security controls for systems deployed on-premises and in the cloud, provide visibility into the security posture of these assets, and recommend improvements to strengthen Income's cyber defence.
-
Automation and AI: Apply automation, SOAR and AI-driven capabilities to streamline repetitive administration and response tasks, consolidate and integrate security controls, and reduce management complexity and cost, with appropriate validation of outputs.