{"id":3451214,"url":"https://alion.io/job/ensign-infosecurity-resident-engineer","title":"Resident Engineer","company":{"id":50230,"name":"Ensign InfoSecurity","domain":"ensigninfosecurity.com","url":"https://alion.io/company/ensign-infosecurity","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"C","score":66,"open_postings":49,"ghost_share":0.653,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":12,"computed_at":"2026-11-03T05:54:40Z"}},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Singapore"],"countries":["SG"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":30000,"max_usd":55000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":288},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Linux","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true}],"status":"closed","first_seen_at":"2026-10-29T11:09:37Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-10-31T19:36:46Z","board_verified":false,"closed_at":"2026-10-31T19:36:46Z","days_open":2,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":1},"description":"Ensign is hiring !\nResponsibilities\nMonitor client environments using SIEM and/or EDR platforms to detect, triage, and respond to cybersecurity threats in accordance with agreed SOPs and industry best practices\nAnalyse and investigate security alerts escalated from client teams, MSSPs, and internal systems; lead or support incident response through to closure\nTriage alerts from the SIEM to identify notable alerts for escalation, based on established operating procedures or industry best practices\nAdvise clients on possible follow-up actions and remediation measures for escalated alerts\nRespond to incidents and critical alerts outside of office hours when required\nPerform indicator of compromise (IOC) searches and triage incoming threat intelligence to assess relevance to client assets\nGather and report on threat intelligence using the client's Threat Intelligence Platform\nCoordinate with client stakeholders including IT, infrastructure, application, and business teams during active incidents and programme activities\nCollaborate with MSSPs and Ensign delivery teams on detection tuning to reduce noise and improve fidelity\nManage detection use cases, dashboards, and reports on SIEM: perform monthly and ad hoc reviews, validate and maintain existing rules, and develop and implement new use cases\nManage playbooks, automation scripts, and integrations on SOAR: review, validate, maintain, and develop new playbooks; optimise existing ones for accuracy and efficiency\nAny other tasks as assigned\nRequirements\nDegree in Computer Science, Information Security, or a related discipline\n3 to 7 years of experience in cybersecurity operations or a Security Operations Centre (SOC) environment\nHands-on experience with SIEM platforms and solid understanding of network, Windows, and Linux infrastructure\nExperience in security, network, and cyber threat analysis\nDemonstrated ability to triage, investigate, and respond to security incidents independently\nComfortable operating in a client-facing, on-site environment with direct accountability to client stakeholders\nClear written and verbal communication; able to produce structured incident reports and brief senior stakeholders\nGIAC Certified Incident Handler (GCIH) or equivalent certification required\nPreferred Skills / Qualities\nWorking knowledge of SOAR platforms; experience with playbook development or automation scripting\nKnowledge of cloud infrastructure security (AWS, Azure, or GCP)\nFamiliarity with Threat Intelligence Platforms and IOC management workflows\nExposure to Singapore regulatory frameworks: CSA advisories, IMDA guidelines, MAS TRM\nAdditional certifications such as GCFE, GCFA, OSCP, or vendor product certifications","description_format":"text","description_chars":2704,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-29T11:09:37Z"},{"event":"close","at":"2026-10-31T19:36:46Z"}],"visa":[],"liveness":null,"pay":null,"html_url":"https://alion.io/job/ensign-infosecurity-resident-engineer","json_url":"https://alion.io/job/ensign-infosecurity-resident-engineer.json","meta":{"generated_at":"2026-11-04T02:39:36Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4070,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":50230},"rest":"https://alion.io/mcp/rest/get_company?id=50230"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fensign-infosecurity-resident-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fensign-infosecurity-resident-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fensign-infosecurity-resident-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ensign-infosecurity-resident-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fensign-infosecurity-resident-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3451214}},{"tool":"search_jobs","arguments":{"company":"ensigninfosecurity.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3451214},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}