Ensign is hiring !
Key Responsibilities:
Develop, customize, and maintain security monitoring content for SIEM and SOAR platforms (e.g., custom rules, alerts, correlation searches, dashboards).
Build automation playbooks for incident response using SOAR platforms to reduce response time and analyst workload.
Integrate new data sources into SIEM tools and ensure parsing, normalization, and enrichment.
Create and maintain scripts and tools to support threat detection, investigation, and reporting.
Work with SOC Analysts and Threat Hunters to develop new detection use cases and improve existing ones.
Participate in the threat lifecycle, assisting in the development of detection logic based on threat intel and attack techniques (e.g., MITRE ATT&CK).
Collaborate with infrastructure and application teams to ensure proper logging and telemetry.
Maintain documentation of code, detection logic, use case coverage, and automation workflows.
Requirements:
Education & Certification:
Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field.
Certifications such as GIAC GMON, GCDA, GCIA, or equivalent are an advantage.
Technical Skills:
Strong experience with SIEM technologies (e.g., Splunk, QRadar, ELK).
Experience with SOAR platforms (e.g., Cortex XSOAR, Splunk Phantom, IBM Resilient).
Proficiency in scripting and development languages such as Python, JavaScript, or Bash.
Familiarity with REST APIs, JSON, and integration methods.
Understanding of cybersecurity concepts, attack techniques, and defensive strategies.
Familiarity with MITRE ATT&CK, cyber threat intelligence, and incident handling workflows.
Skills Required
- Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or related field
- Certifications such as GIAC GMON, GCDA, GCIA, or equivalent
- Strong experience with SIEM technologies
- Experience with SOAR platforms
- Proficiency in scripting and development languages
- Familiarity with REST APIs and JSON
- Understanding of cybersecurity concepts and attack techniques
- Familiarity with MITRE ATT&CK and incident handling workflows
What We Do
Ensign InfoSecurity is the largest pure-play end-to-end cybersecurity service provider in Asia. Headquartered in Singapore, Ensign offers bespoke solutions and services to address their clients’ cybersecurity needs. Their core competencies are in the provision of cybersecurity advisory and assurance services, architecture design and systems integration services, and managed security services for advanced threat detection, threat hunting, and incident response. Underpinning these competencies is in-house research and development in cybersecurity. Ensign has two decades of proven track record as a trusted and relevant service provider, serving clients from the public and private sectors in the Asia Pacific region
